New GPUThor attack defeats NVIDIA ECC protection for root access

GPUThor is a Rowhammer attack that circumvents NVIDIA's SECDED ECC memory protections on Ampere-class GPUs with GDDR6 memory by using a non-uniform hammering pattern that avoids triggering Target Row Refresh mitigations. The attack exploits two undocumented GPU behaviors related to memory request coalescing and TRR activation frequency, resulting in bit-flip rates vastly exceeding previous GPU Rowhammer attacks. With ECC enabled, GPUThor still generates detectable double-bit errors and some triple-bit errors that cause incorrect ECC repairs, leading to data corruption. The attack can cause denial-of-service by forcing GPU resets and hardware replacement flags, and can escalate privileges to root by corrupting GPU page tables, granting arbitrary memory access to unprivileged CUDA programs. The attack affects RTX A4000, A4500, A5000, and A6000 GPUs, with potential applicability to server-class Ampere GPUs like the A100. NVIDIA's advisory recommends enabling SYS-ECC and IOMMU/DMA isolation, monitoring GPU error telemetry, and restricting untrusted workloads. The researchers note that future GPUs with stronger multi-bit ECC and hardware defenses will be needed for complete mitigation.

GPUThor enables denial-of-service by causing periodic GPU resets and eventual hardware marking for replacement on affected NVIDIA GPUs. It also allows privilege escalation to root level by corrupting GPU page tables, enabling unprivileged CUDA programs to gain arbitrary memory access and open a root shell on the host system. This compromises system integrity and confidentiality on systems using vulnerable GPUs. The attack significantly increases bit-flip rates compared to previous GPU Rowhammer attacks, reducing the time to find exploitable bit flips from hours to minutes. While ECC detects many errors, some multi-bit errors cause incorrect ECC repairs leading to data corruption. The risk varies by GPU model and memory technology, with no bit flips observed on tested GDDR6X or HBM2e GPUs.

NVIDIA has published an advisory recommending enabling SYS-ECC and IOMMU/DMA isolation features to mitigate GPUThor. Monitoring GPU error telemetry and restricting the sharing or execution of untrusted CUDA workloads are also advised. Avoiding cross-tenant GPU sharing where possible and monitoring ECC error counters can help detect attacks. Complete protection likely requires future GPUs with stronger multi-bit ECC and hardware-level defenses. Users should consult the official NVIDIA advisory for detailed guidance. Patch status is not explicitly stated; check the vendor advisory for current remediation updates.