PaperlayerView exact revision on arXiv

Source-linked AI summary

GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs

Chris S. Lin, Joyce Qu, Aditya Rajeev, Gururaj Saileshwar

arXiv:2609.16546v1cs.CR

TL;DR

Prior GPU Rowhammer attacks generated far fewer bit flips than CPU attacks, limiting their practicality and making ECC an effective defense. GPUThor reverse-engineers GPU coalescing and GDDR6 mitigation timing to construct high-intensity, non-uniform multi-tREFI patterns. It achieves 500×–23,500× more flips than prior GPU attacks and enables denial-of-service and privilege-escalation attacks on ECC-protected GPUs.

  • Problem

    Prior GPU Rowhammer attacks produce orders of magnitude fewer bit flips than CPU attacks, limiting practicality and allowing ECC to mitigate them.

  • Method

    GPUThor reverse-engineers GPU memory-access coalescing and GDDR6 TRR timing to construct non-uniform multi-tREFI hammering patterns.

  • Results

    500×–23,500× more bit flips than prior GPU attacks, plus uncorrectable multi-bit flips and attacks on ECC-enabled GPUs.

  • Takeaways & Limitations

    ECC does not prevent the demonstrated GPUThor denial-of-service and privilege-escalation attacks on ECC-protected GPUs.

  • Takeaways & Limitations

    GPUThor induced flips on tested GA10x GDDR6 GPUs but not on evaluated HBM, GDDR6X, or newer-generation GDDR6 GPUs.

Abstract

from arXiv · show

GDDR memory in GPUs is vulnerable to Rowhammer attacks, where rapid memory accesses induce bit flips in adjacent cells, enabling data tampering and privilege escalation. However, prior GPU Rowhammer attacks trigger only tens to hundreds of bit flips, orders of magnitude fewer than CPU attacks, severely limiting their practical impact. This gap stems from the reliance of existing GPU Rowhammer attacks on uniform hammering patterns that activate aggressor and decoy rows equally, which results in low hammering intensity for aggressor rows. We present GPUThor, a high-intensity Rowhammer attack on NVIDIA GPUs leveraging non-uniform hammering. GPUThor reverse engineers GPU memory-access coalescing behavior to enable non-uniform hammering patterns on GPUs, that activate aggressor rows more intensely than decoy rows. Additionally, by identifying refresh instances when in-DRAM mitigations are applied, it constructs longer attack patterns that escape mitigation across refresh intervals, further increasing hammering intensity. Together, these techniques yield 500X to 23,500X more bit flips than prior GPU Rowhammer attacks, across several NVIDIA GPUs (A4000, A4500, A5000, A6000), reaching bit flip rates close to state-of-the-art CPU Rowhammer attacks. GPUThor also enables the first Rowhammer exploits on ECC-protected GPUs, inducing uncorrectable double and triple bit flips, making denial-of-service and privilege-escalation attacks practical even on GPUs with ECC enabled.

1 Introduction

GPUThor addresses the low bit-flip rates of prior GPU Rowhammer attacks by defeating GPU coalescing and exploiting mitigation timing to enable high-intensity, non-uniform patterns. It produces substantially more flips and demonstrates attacks against ECC-protected GPUs.

  • Motivation: Prior GPU attacks produced only tens to hundreds of bit flips, far below CPU attacks and limiting their practicality.GPUHammer, GeForge, GPUBreach, and GDDRHammer used largely uniform patterns, while Blacksmith reached 550,000 flips/GB on DDR4.
  • Approach: GPUThor distributes repeated aggressor accesses across warps and independent cachelines, avoiding coalescing and increasing hammering intensity by 2–3× over prior work.Requests within a warp are aggressively coalesced, whereas requests across warps are typically not.
  • Approach: GPUThor uses patterns spanning up to six tREFIs after identifying that TRR mitigation occurs approximately once every 72 tREFIs.The resulting patterns reach nearly 6.6 aggressor activations per tREFI while reserving decoy accesses to overwhelm TRR.
  • Results: 500× to 23,500× more bit flips per GB than prior GPU attacks, reaching 72,000–377,000 flips/GB across four NVIDIA GPUs.The evaluated GPUs are the A4000, A4500, A5000, and A6000.
  • Security impact: GPUThor induces 387 double-bit and 2 triple-bit flips that SECDED ECC cannot fully protect against, including on ECC-enabled GPUs.The paper reports denial-of-service and privilege-escalation attacks on ECC-protected GPUs.

2 Background

GPU Rowhammer exploits DRAM disturbance by repeatedly activating rows adjacent to victims, while GPU memory hierarchies, TRR, and ECC shape how attacks work and are defended. Prior GPU attacks mainly used uniform patterns and produced far fewer flips than CPU attacks.

  • GPU memory system: NVIDIA GPUs route SM memory requests through L1/L2 caches and memory controllers to GDDR6 channels, chips, banks, and row buffers.Each GDDR6 chip contains 16 banks, and rows within a bank share a row buffer.
  • Rowhammer: Rowhammer repeatedly activates aggressor rows to leak charge from adjacent victim rows and induce bit flips.The minimum activations needed to induce a flip is the Rowhammer threshold, HCfirst.
  • Defenses: TRR refreshes neighbors of frequently activated rows, but attackers can interleave decoy rows to overwhelm finite-capacity tracking.This mitigation-avoidance strategy motivates hammering patterns that mix aggressor and decoy accesses.
  • Prior GPU attacks: Prior GPU attacks largely used uniform hammering and produced only tens of bit flips per bank, making ECC effective against them.GPUHammer, GDDRHammer, and GeForge demonstrated GPU Rowhammer attacks but remained far below CPU attack rates.
  • ECC: SECDED ECC corrects single-bit errors, detects but cannot correct double-bit errors, and can mis-correct errors involving three or more flipped bits.Double-bit errors produce detectable uncorrectable errors, while three or more flips can cause silent data corruption.

3 Overview of GPUThor

GPUThor is a high-intensity, non-uniform Rowhammer attack on NVIDIA GPUs that combines coalescing-aware access patterns with multi-tREFI hammering. It uses reverse-engineered GPU memory behavior and GDDR6 mitigation timing to increase aggressor activations.

  • Overview: GPU memory coalescing makes repeated aggressor activations difficult because accesses within warps can be merged before producing distinct DRAM activations.GPUThor characterizes coalescing across access levels and uses the regime that preserves repeated activations.
  • Overview: GPUThor distributes repeated aggressor accesses across multiple warps and unique cachelines to enable non-uniform hammering.This design targets repeated activations while avoiding the coalescing behavior observed within warps and across shared addresses.
  • Overview: GPUThor combines two building blocks: defeating GPU request coalescing and developing multi-tREFI non-uniform hammering patterns.The resulting pattern spans 6 tREFIs, with aggressor activations concentrated in the first five and decoys reserved for the final tREFI.
  • Overview: TRR mitigation on Ampere GDDR6 GPUs occurs approximately once every 72 tREFIs rather than once per tREFI.GPUThor uses this timing to construct patterns spanning multiple tREFIs, reaching up to 6.6 aggressor activations per tREFI.

4 Defeating GPU Memory Request Coalescing

GPUThor defeats GPU request coalescing by distributing repeated aggressor accesses across warps and distinct cachelines. Timing measurements show that within-warp repeats are coalesced, whereas cross-warp accesses to distinct cachelines preserve repeated activations.

  • 4.2 Coalescing Within a Warp: Repeated requests within one warp are coalesced and do not generate unique ACTs, making them unsuitable for non-uniform hammering.The uniform 9-ACT baseline takes 484 ns per round, while same-warp repeated patterns take 469 ns, indicating fewer than 9 ACTs.
  • 4.3 Coalescing Across Warps: 502 ns and 573 ns per round for 2× and 3× same-cacheline cross-warp patterns exceed the 484 ns baseline because cache eviction increases access latency.The timing spike reflects cache interference rather than a clean measurement of additional ACTs.
  • 4.3 Coalescing Across Warps: Repeated requests from different warps to distinct cachelines are not coalesced and generate unique ACTs suitable for non-uniform hammering.Using cachelines at least 128 B apart avoids the same-cacheline interference observed in cross-warp patterns.
  • 4.4 Non-Uniform Hammering in a Single tREFI: 32.5 average bit flips from 2× single-tREFI intensity exceed the 21-flip uniform baseline by 1.5× on an A5000.Increasing intensity to 3× or 4× decreases flips because decoy placement becomes constrained and less effective against TRR sampling.

5 Multi-tREFI Hammering on GPUs

GPUThor extends non-uniform hammering across multiple tREFIs to increase aggressor intensity while evading TRR. Patterns aligned with the inferred 72-tREFI mitigation period reliably trigger flips, with a 6-tREFI pattern reaching 6.6 ACTs per tREFI.

  • 5.1 Increasing Pattern Lengths to n tREFIs: TRR mitigations likely occur every 72 tREFIs, rather than once per tREFI, based on reproducibility across multi-tREFI pattern lengths.This timing enables longer attack patterns that place decoys across the mitigation interval.
  • 5.1 Increasing Pattern Lengths to n tREFIs: Pattern lengths of 3, 4, 6, 9, 18, and 24 tREFIs exceed 10% flip probability, while reliable flips stop after 36 tREFIs.Across tested lengths, reproducibility is associated with patterns that divide the inferred 72-tREFI mitigation interval.
  • 5.2 Increasing Intensity for n-tREFI Patterns: 6.6 ACTs per tREFI is reproducibly achieved by the 6-tREFI pattern, making it suitable for larger bit-flip campaigns.Longer patterns can sustain higher intensity, while flip probability generally declines at still higher activation rates.
  • 5.2 Increasing Intensity for n-tREFI Patterns: Single-sided and double-sided patterns reach a similar combined limit of at most 7 ACTs per tREFI, apparently constrained by GDDR6 TRR.Splitting activations across both adjacent aggressors does not increase achievable intensity.
  • GPUThor Pattern: GPUThor’s final pattern spans 6 tREFIs, uses 6.6 ACTs per tREFI for aggressors, and reserves the last tREFI for decoy accesses.The first five tREFIs combine repeated aggressor and decoy activations to defeat coalescing and overwhelm TRR.

6 Results

GPUThor substantially increases bit flips and reduces privilege-escalation time across four NVIDIA GPUs, while producing multi-bit flips relevant to ECC attacks.

  • 6.2 Bit Flip Characterization: 18,000–94,000 unique bit flips were produced across four GPUs, yielding 143×–2,602× more flips than GPUHammer.The campaigns targeted four banks on each A4000, A4500, A5000, and A6000.
  • 6.2 Bit Flip Characterization: 377K flips/GB on the A5000 approached Blacksmith’s 550K flips/GB CPU rate, while the A4000, A4500, and A6000 reached 72K, 75K, and 114K flips/GB.The A5000 was the most vulnerable GPU in the test set.
  • 6.2 Bit Flip Characterization: On the A5000, GPUThor generated 3,584 flips per hour, almost 180× faster than GDDRHammer’s 20 flips per hour.This comparison used single-bank GPUThor hammering versus GDDRHammer’s multi-bank configuration.
  • 6.3 Time to Exploit: GPUThor reduced total privilege-escalation exploit time to 0.6–1.2 minutes across all GPUs, 10×–1,200× lower than GPUHammer.Bit-flip discovery fell to 0.1–0.6 minutes, while the online phase remained 0.2–0.3 minutes.
  • 6.4 Multi-Bit Flips: GPUThor produced double-bit flips on every GPU and triple-bit flips on the A5000, including four triple-bit flips at 32 B granularity.At 16 B granularity, the A5000 and A6000 reached 137 and 26 double-bit flips per bank, respectively.

7 Implications for ECC Protections on GPUs

GPUThor exposes how NVIDIA ECC responds to Rowhammer-induced multi-bit errors and shows that ECC-enabled GPUs remain vulnerable to corruption, denial of service, and exploitation.

  • 7.1 Reverse Engineering ECC on NVIDIA GPUs: 94 DUEs and 1 SDC were observed on an ECC-enabled A6000 across four banks.ECC-enabled campaigns were run only on the local A6000 because cloud GPUs did not expose permissions to enable ECC.
  • 7.2 Insights on NVIDIA ECC Implementation: NVIDIA ECC appears to protect 32 B of data with two 1 B SECDED codes, each covering 16 B of data.The inference is based on DUEs containing at least two flipped bits within 32 B and simultaneous correction of two bits separated across 16 B regions.
  • 7.3 Exploits on ECC-Enabled GPUs: A DUE leaves GPU kernels alive for approximately 10 ms, allowing corrupted data or corrupted PTEs to be consumed before termination.This lazy servicing creates a window for DUE-based exploitation.
  • 7.2 Insights on NVIDIA ECC Implementation: Triple-bit flips within an ECC granularity were mis-corrected into silent data corruption rather than detected as an error that crashes the kernel.The observed miscorrection can flip a fourth bit at a deterministic location.
  • 7.3 Exploits on ECC-Enabled GPUs: On GA10x GPUs without Error Containment, DUEs kill all running processes; the measured rate reduced cloud-node availability by 22.7%, or about 5.5 hours per day.The A6000 produced an average of 23.5 DUEs per bank within one day of hammering.

8 Privilege Escalation Exploit with ECC Enabled

The paper demonstrates privilege escalation on ECC-enabled GPUs by exploiting either silent data corruption or the brief execution window after a detectable uncorrectable error.

  • 8.2 Offline Profiling for DUEs and SDCs: The exploit targets 2 MB-page PTEs and requires flipped bits in the 25-bit Page Frame Number region that resolve to user-accessible memory.Miscorrections from DUEs or SDCs add uncertainty beyond the original Rowhammer-induced flips.
  • 8.2 Offline Profiling for DUEs and SDCs: Exhausting a bank’s row remapper after eight DUEs makes later DUE locations persistent and reproducible after resets and reboots.The paper reports reaching this state within 18 hours on the A6000.
  • 8.3 Exploit Results: On the ECC-enabled A6000, one SDC and 26 of 94 DUEs were suitable for exploitation; the offline phase took four days and the online phase under two minutes.cuMemMap and TLB flushing accounted for most of the online time.
  • 8 Privilege Escalation Exploit with ECC Enabled: An SDC-based exploit achieved host-side privilege escalation with ECC enabled, even when the IOMMU was enabled.The exploit used the arbitrary read/write primitive obtained from corrupted GPU page tables.
  • 8 Privilege Escalation Exploit with ECC Enabled: A DUE-based exploit can use corrupted PTEs during the approximately 10 ms interval before GPU kernels are terminated.The approach modifies PTE aperture bits and relies on systems where the IOMMU is disabled.

9 Discussion and Limitations

GPUThor’s demonstrated applicability is limited to the tested GA10x GDDR6 GPUs, while newer reliability mechanisms alter some exploit consequences without eliminating all risks described by the paper.

  • 9 Discussion and Limitations: GPUThor induced bit flips on the tested A4000, A4500, A5000, and A6000, but not on evaluated HBM, GDDR6X, or newer-generation GDDR6 GPUs.The differences may reflect variations in TRR implementations and Refresh Management.
  • 9 Discussion and Limitations: Error Containment and Dynamic Page Offlining on newer server-class GPUs can isolate faults and reduce denial-of-service impact, but SECDED-level ECC still permits the described SDC-based privilege escalation.RAS Repair makes DUE-based attacks more time-consuming rather than preventing them.

10 Mitigations

The paper discusses stronger ECC, ECC-state monitoring, and hardware-level defenses as mitigations for GPU Rowhammer, while identifying practical overheads and monitoring blind spots.

  • Stronger Error Correction: Stronger ECC can improve resilience to multi-bit flips, but may incur nonnegligible storage and bandwidth overheads.SECDED ECC in GDDR6 already incurs 6.25% memory overhead and up to 10% slowdown.
  • ECC State Monitoring: ECC-state monitoring may reveal attacks through row-remapper activity or corrected-error counts, but both signals have evasion-enabling limitations.The row remapper triggers only on DUEs, while the correctable-error counter becomes unreliable after a few thousand errors.
  • Principled Hardware-Level Defenses: In-DRAM mitigations, memory-controller defenses, and DRAM integrity protections can mitigate GPUThor attacks or detect and prevent Rowhammer corruption.Examples include Refresh Management, Per-Row Activation Counting, tracker-based defenses, and integrity protections.

11 Related Work

Related work establishes Rowhammer as a broad DRAM and GPU security threat, while surveying software and hardware defenses developed primarily for CPU memory.

  • Rowhammer Attacks: CPU Rowhammer research has bypassed in-DRAM mitigations and enabled privilege escalation, fault injection, data leakage, and attacks on machine-learning systems.ECCploit and ECC.fail show that ECC does not inherently prevent Rowhammer on CPU DRAM.
  • GPU Vulnerabilities: Prior GPU research exposes vulnerabilities involving residual-memory leakage, side channels, memory corruption, privilege escalation, and CPU-GPU communication.These attacks can leak renders, ML outputs, pixels, model parameters, and other sensitive information.
  • Rowhammer Mitigations: Existing Rowhammer mitigations include memory isolation, ECC-driven remapping, rate limiting, tracker schemes, row relocation, delayed activations, and PRAC-based defenses.Most defenses target CPU DRAM, though some may extend to GPUs with driver support.

12 Conclusion

GPUThor demonstrates a high-intensity non-uniform Rowhammer attack on NVIDIA GPUs that substantially amplifies bit flips and defeats the protection assumed from SECDED ECC.

  • 12 Conclusion: 500×–23,500× more bit flips than prior GPU attacks are achieved across GPUThor’s NVIDIA evaluations.The attack induces multi-bit flips uncorrectable by SECDED ECC.
  • 12 Conclusion: GPUThor enables denial-of-service attacks and the first privilege-escalation attacks on ECC-enabled GPUs.The authors conclude that enabling ECC, as NVIDIA recommends, is insufficient and stronger defenses are needed.
  • 12 Conclusion: The artifact includes code for the main Rowhammer campaigns, reverse engineering, and ECC experiments.The code is identified as available through the project repository.
  • 12 Conclusion: Experiments were conducted on locally owned GPUs or controlled cloud VMs, with ECC-enabled denial-of-service and privilege-escalation experiments restricted to locally owned GPUs.The findings were responsibly disclosed to NVIDIA and major cloud providers before public disclosure.

D Evaluation on Other GPUs

Additional evaluations characterize GPUThor’s dependence on GPU model, data pattern, aggressor-victim distance, and decoy-row selection, revealing both attack scope and pattern-specific behavior.

  • D Evaluation on Other GPUs: Only the A4000–A6000 GPUs with GDDR6 produced bit flips under GPUThor’s tested patterns; other tested GPUs did not.The other GPUs may have different TRR implementations or may lack vulnerability to Rowhammer.
  • E Data Pattern Dependency: More than half of observed campaign flips came from the 0xff/00 victim/attacker data pattern.Figure 12 compares the percentage of unique flips found per data pattern for each GPU.
  • E Data Pattern Dependency: Most data patterns triggered flips in victim rows at logical aggressor-victim distances of at most 15 rows, supporting non-linear logical-to-physical row mapping.Figure 13 reports distance distributions across all campaigns and GPUs.
  • E Data Pattern Dependency: The 0xAA/55 pattern triggered flips only when aggressors were within logical distance 3, suggesting spatially dependent susceptibility.The paper hypothesizes that differences in bank data scramblers may explain this pattern dependence and leaves possible side-channel exploration for future work.
  • D Evaluation on Other GPUs: At higher aggressor activation counts, successful 18-tREFI attacks required exponentially more unique decoy rows rather than repeated activations to the same rows.At 56 ACTs or less, 16 unique decoys suffice, whereas 135 ACTs can require up to 400 unique decoy rows.
Loading 2609.16546v1…