New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access

Researchers at the University of Toronto have disclosed GPUThor, a Rowhammer attack that bypasses error correction code (ECC) protections on NVIDIA RTX A6000 workstation GPUs, allowing attackers to execute privilege escalation and gain root access to host systems.

Rowhammer attacks exploit a hardware vulnerability in DRAM by repeatedly accessing the same memory row. This causes electrical interference that flips bits in adjacent memory rows, corrupting data and potentially breaking security boundaries. NVIDIA previously recommended ECC as the primary mitigation against GPU Rowhammer attacks. GPUThor demonstrates that this defense is insufficient on NVIDIA's professional-grade RTX A6000 graphics processors equipped with GDDR6 memory.

The attack works by hammering four DRAM rows simultaneously, overwhelming the ECC protection mechanism. ECC typically detects and corrects single-bit errors, but simultaneous bit flips across multiple rows create a scenario where ECC cannot function reliably. Once ECC fails, attackers flip critical bits in kernel memory or other privileged data structures, enabling them to escalate privileges from a local user account to root level access on the host system.

The RTX A6000 targets professional workloads in data centers, scientific computing, and machine learning environments. These systems often process sensitive data and run containerized workloads. A successful privilege escalation allows attackers to escape GPU sandboxes, access host operating systems, and potentially pivot to other connected infrastructure.

The attack requires local code execution on the GPU first. An attacker must run a malicious GPU kernel or application that triggers the Rowhammer pattern. This means the threat primarily affects systems where users lack strict isolation from one another or where untrusted code execution occurs. Cloud GPU providers, shared academic computing clusters, and enterprise environments running multiple workloads on single GPU servers face the highest risk.

NVIDIA has not yet published official security updates or patches addressing GPUThor. The company's prior recommendations centered on enabling ECC and limiting GPU memory access. Neither approach fully mitigates the attack. System administrators cannot disable the vulnerability through configuration alone. Mitigation requires either hardware redesign or firmware-level changes that NVIDIA has not yet released.

The disclosure follows a pattern of increasing attention to GPU security. Previous Rowhammer attacks targeted CPU DRAM, but researchers have progressively shown that GPUs present a similar surface. Unlike CPUs, GPUs often run code from multiple concurrent applications with weaker isolation boundaries. This architectural difference amplifies the risk.

Organizations deploying RTX A6000 GPUs should assume that local code execution could lead to complete host compromise. Workload isolation strategies become critical. These include restricting GPU access to trusted users, implementing mandatory access controls, and segmenting systems by security level. Air-gapped systems running only vetted code face lower risk, but systems running customer workloads or untrusted applications require immediate review.

Researchers at the University of Toronto disclosed the attack through responsible disclosure channels. NVIDIA likely received advance notice and has had time to assess the flaw. The company must now decide whether to issue microcode updates, recommend hardware replacement, or issue additional guidance. GPUThor represents a fundamental hardware limitation that software patches alone may not fully resolve.

This disclosure raises broader questions about ECC reliability and Rowhammer mitigations across GPU architectures. As GPU computing expands into security-sensitive domains, hardware vendors must prioritize attack surface reduction and provide transparent security guidance.