12:43Machine-translated from Azerbaijani by AIRead in Azerbaijani
First Rowhammer Attack to Bypass ECC on Nvidia Graphics Cards Disclosed
4 researchers at the University of Toronto have disclosed the first Rowhammer attack to bypass ECC protection on Nvidia graphics cards. The technique, called GPUThor, makes it possible to obtain the highest level of administrative privileges on the computer to which the graphics card is connected. ECC, however, is designed to detect and correct memory errors. The attack affects the Ampere-generation RTX A4000, RTX A4500, RTX A5000, and RTX A6000 workstation graphics cards with GDDR6 memory. A CUDA program running with ordinary privileges is sufficient to carry out the attack. The research will be presented at the ACM CCS 2026 conference.
During a Rowhammer attack, the same row in DRAM memory is activated rapidly and repeatedly. This reduces the electrical charge in adjacent rows, ultimately causing bit flips. The program carrying out the attack does not directly access protected data. This vulnerability can be exploited to modify data, escape an isolated environment, and obtain higher privileges. An internal defense mechanism called TRR monitors suspicious activity and attempts to prevent such changes by refreshing adjacent memory rows in time. GPUThor accesses memory rows at varying levels of intensity rather than at a constant rate. The researchers were also able to bypass the GPU’s mechanism for coalescing memory requests. They determined that TRR protection activates only 1 time every 72 refresh intervals. This made it possible to access memory 6.6 times more intensively than in previous attacks. The technique resembles the Blacksmith attack used against processors.
With ECC disabled, 72,000–377,000 bit flips per 1 GB of memory were recorded on each of the 4 graphics cards. The RTX A5000 was the most vulnerable model. For comparison, the Blacksmith attack targeting processors produces approximately 550,000 bit flips in DDR4 memory. Enabling ECC reduced the number of errors, but the protection could not stop them completely. The tests produced two-bit errors and 2 three-bit errors. In some cases, ECC accepted an incorrect value as the correct result.
On an RTX A6000 with ECC enabled, GPUThor caused the graphics card to restart every 2 hours. When this happened, all processes running on the graphics card stopped. The device was also flagged within 1 day as hardware that needed to be returned for service. Over the past 1 year, Nvidia had recommended ECC as the primary defense against earlier Rowhammer attacks. GPUHammer, which emerged in 2025, and GPUBreach, disclosed earlier this year, did not work when ECC was enabled. The new technique was able to bypass this protection. The researchers presented the attack method on April 29, 2026, first to Nvidia and later to teams at Google, Microsoft, and AWS. The research was not publicly disclosed until August 25. The GPUThor code is scheduled to be released publicly on November 15 this year. The vulnerability currently has no official CVE number. A security update addressing the issue has also not yet been released.
During a Rowhammer attack, the same row in DRAM memory is activated rapidly and repeatedly. This reduces the electrical charge in adjacent rows, ultimately causing bit flips. The program carrying out the attack does not directly access protected data. This vulnerability can be exploited to modify data, escape an isolated environment, and obtain higher privileges. An internal defense mechanism called TRR monitors suspicious activity and attempts to prevent such changes by refreshing adjacent memory rows in time. GPUThor accesses memory rows at varying levels of intensity rather than at a constant rate. The researchers were also able to bypass the GPU’s mechanism for coalescing memory requests. They determined that TRR protection activates only 1 time every 72 refresh intervals. This made it possible to access memory 6.6 times more intensively than in previous attacks. The technique resembles the Blacksmith attack used against processors. With ECC disabled, 72,000–377,000 bit flips per 1 GB of memory were recorded on each of the 4 graphics cards. The RTX A5000 was the most vulnerable model. For comparison, the Blacksmith attack targeting processors produces approximately 550,000 bit flips in DDR4 memory. Enabling ECC reduced the number of errors, but the protection could not stop them completely. The tests produced two-bit errors and 2 three-bit errors. In some cases, ECC accepted an incorrect value as the correct result. On an RTX A6000 with ECC enabled, GPUThor caused the graphics card to restart every 2 hours. When this happened, all processes running on the graphics card stopped. The device was also flagged within 1 day as hardware that needed to be returned for service. Over the past 1 year, Nvidia had recommended ECC as the primary defense against earlier Rowhammer attacks. GPUHammer, which emerged in 2025, and GPUBreach, disclosed earlier this year, did not work when ECC was enabled. The new technique was able to bypass this protection. The researchers presented the attack method on April 29, 2026, first to Nvidia and later to teams at Google, Microsoft, and AWS. The research was not publicly disclosed until August 25. The GPUThor code is scheduled to be released publicly on November 15 this year. The vulnerability currently has no official CVE number. A security update addressing the issue has also not yet been released.