GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs

A high-intensity Rowhammer attack achieving 500X-23,500X more bit flips on NVIDIA GPUs and the first exploits on ECC-protected GPUs

Chris S. Lin; Joyce Qu; Aditya Rajeev; Gururaj Saileshwar· 2026· DOI 10.48550/arXiv.2609.16546

The core problem

GDDR memory in GPUs is vulnerable to Rowhammer attacks, where rapid memory accesses induce bit flips in adjacent cells, enabling data tampering and privilege escalation. However, prior GPU Rowhammer attacks trigger only tens to hundreds of bit flips, orders of magnitude fewer than CPU attacks, severely limiting their practical impact. This gap stems from the reliance of existing GPU Rowhammer attacks on uniform hammering patterns that activate aggressor and decoy rows equally, which results in low hammering intensity for aggressor rows. The paper presents GPUThor, a high-intensity Rowhammer attack on NVIDIA GPUs leveraging non-uniform hammering. The work addresses the critical need for practical GPU Rowhammer attacks by overcoming the intensity limitations of prior approaches.

Together, these techniques yield 500X to 23,500X more bit flips than prior GPU Rowhammer attacks, across several NVIDIA GPUs (A4000, A4500, A5000, A6000), reaching bit flip rates close to state-of-the-art CPU Rowhammer attacks. GPUThor also enables the first Rowhammer exploits on ECC-protected GPUs, inducing uncorrectable double and triple bit flips, making denial-of-service and privilege-escalation attacks practical even on GPUs with ECC enabled. The results demonstrate a significant advancement in GPU Rowhammer attack effectiveness, with bit flip counts increasing by up to four orders of magnitude. The evaluation covers multiple GPU models, showing consistent improvement across the board. The ability to induce uncorrectable errors on ECC-protected GPUs is particularly notable, as ECC was previously considered a strong mitigation against Rowhammer.

GDDR memory in GPUs is vulnerable to Rowhammer attacks, where rapid memory accesses induce bit flips in adjacent cells, enabling data tampering and privilege escalation. However, prior GPU Rowhammer attacks trigger only tens to hundreds of bit flips, orders of magnitude fewer than CPU attacks, severely limiting their practical impact. This gap stems from the reliance of existing GPU Rowhammer attacks on uniform hammering patterns that activate aggressor and decoy rows equally, which results in low hammering intensity for aggressor rows. The paper presents GPUThor, a high-intensity Rowhammer attack on NVIDIA GPUs leveraging non-uniform hammering. The work addresses the critical need for practical GPU Rowhammer attacks by overcoming the intensity limitations of prior approaches.

GPUThor reverse engineers GPU memory-access coalescing behavior to enable non-uniform hammering patterns on GPUs, that activate aggressor rows more intensely than decoy rows. Additionally, by identifying refresh instances when in-DRAM mitigations are applied, it constructs longer attack patterns that escape mitigation across refresh intervals, further increasing hammering intensity. The attack methodology involves two key techniques: (1) non-uniform hammering via coalescing-aware pattern generation, and (2) refresh-aware pattern construction to bypass in-DRAM mitigations. These techniques are implemented and evaluated on several NVIDIA GPUs (A4000, A4500, A5000, A6000). The following Mermaid diagram illustrates the high-level attack flow:

The findings highlight a critical vulnerability in GPU memory systems, particularly in the context of ECC protection. The non-uniform hammering approach exploits the coalescing behavior of GPU memory accesses, which was previously overlooked in attack design. By intensifying aggressor rows, GPUThor achieves bit flip rates comparable to CPU attacks, narrowing the gap between GPU and CPU Rowhammer effectiveness. The refresh-aware pattern construction further bypasses in-DRAM mitigations, demonstrating that current defenses are insufficient. The implications are significant for GPU security, as GPUs are widely used in cloud computing, AI, and high-performance computing. The ability to induce uncorrectable errors on ECC-protected GPUs challenges the assumption that ECC provides robust protection. Future work may explore additional non-uniform patterns and defenses. The paper's taxonomy candidates include Architecture, Cybersecurity, Network, and Cryptography, reflecting the interdisciplinary nature of the work.

CS practitioners and researchers

Opening member content…