New GPUBreach Attack Enables System Takeover Through GPU Rowhammer

What happened

A new attack called GPUBreach shows that Rowhammer bit flips in GPU memory can be used to escalate privileges and compromise an entire system. The technique was developed by researchers at the University of Toronto, who said it can corrupt GPU page tables in GDDR6 memory and give an unprivileged CUDA kernel arbitrary GPU memory read and write access. From there, the attack can be chained into CPU-side privilege escalation by exploiting memory-safety bugs in the NVIDIA driver. The researchers said this can lead to full system compromise up to a root shell without disabling IOMMU, a hardware protection designed to block many direct memory attacks. They demonstrated the result on an NVIDIA RTX A6000, a GPU widely used in AI development and training workloads. 

Who is affected

The direct exposure affects organizations using systems with NVIDIA GPUs that rely on GDDR6 memory, particularly environments running AI development and training workloads. The researchers said consumer GPUs without ECC are completely unmitigated against this attack, while IOMMU alone is not enough to stop it. 

Why CISOs should care

This matters because the research moves GPU Rowhammer from a data corruption problem into a privilege escalation path that can end in full system takeover. It also challenges the assumption that IOMMU is sufficient protection against GPU-driven memory attacks, especially in environments where GPUs are trusted components inside high-value compute systems. 

3 practical actions

1. Reassess GPU trust assumptions: Review whether GPU-equipped systems are being treated as trusted platforms even though the research shows GPU memory corruption can lead to broader system compromise. 
2. Do not rely on IOMMU alone: Update hardening assumptions for high-risk systems because the researchers said GPUBreach can succeed even when IOMMU protections remain enabled. 
3. Prioritize ECC-capable environments where possible: Factor ECC support into risk decisions for sensitive GPU workloads, since the researchers said consumer GPUs without ECC remain completely unmitigated. 

For more news about critical software and hardware security flaws, click Vulnerability to read more.