GPUThor Rowhammer Attack Bypasses NVIDIA GPU ECC Protections

Security researchers have disclosed a new Rowhammer attack called GPUThor that can bypass error-correcting code (ECC) protections on certain NVIDIA GPUs. The attack may allow threat actors to cause denial-of-service (DoS) conditions and potentially escalate privileges to root on host systems.

In a paper published by researchers at the University of Toronto, GPUThor achieved substantially higher bit-flip rates than earlier GPU-based attacks, including GPUHammer and GPUBreach. Those attacks became less effective after NVIDIA introduced ECC protections in its graphics memory.

The researchers demonstrated GPUThor against Ampere-generation NVIDIA workstation GPUs using GDDR6 memory, including the RTX A4000, RTX A4500, RTX A5000, and RTX A6000. These GPUs are commonly deployed in AI, cloud computing, and other high-performance workloads.

How the GPUThor attack works

Rowhammer attacks repeatedly access memory rows, or “hammer” them, to increase the likelihood of flipping bits in nearby memory cells. A bit flip changes a stored value from 1 to 0 or from 0 to 1, potentially causing data corruption, crashes, or security issues.

These risks are particularly significant in GPU-accelerated environments. AI model training and inference depend heavily on GPU memory and processing power, meaning successful memory corruption could affect model accuracy, disrupt workloads, or compromise isolation between users.

NVIDIA uses mitigations such as SECDED ECC to help protect supported GPU memory. This technology can correct single-bit errors and detect, but not correct, double-bit errors in monitored memory blocks.

However, the University of Toronto researchers developed a more efficient hammering technique for GPUThor. The attack uses an uneven access pattern designed to avoid triggering Target Row Refresh (TRR), a GDDR6 mitigation intended to reduce Rowhammer-induced bit flips.

The technique accounts for two undocumented GPU behaviors: how repeated memory requests are combined and how frequently the TRR mitigation is activated.

According to the researchers, these changes produced 6.6 times more aggressor-row activations than previous approaches. On GPUs tested without ECC, GPUThor generated between 72,000 and 377,000 bit flips per gigabyte of memory.

The results were between 4,548 and 23,597 times higher than those achieved by the researchers’ earlier GPUHammer attack. They also approached the bit-flip rates of advanced CPU Rowhammer techniques such as Blacksmith.

At this rate, GPUThor can reportedly find an exploitable bit flip in approximately 1.1 minutes. By comparison, GPUHammer required about 21.9 hours to achieve similar results.

With ECC enabled, the researchers observed 387 double-bit errors that ECC detected but could not correct. They also recorded two triple-bit errors that ECC incorrectly repaired, resulting in data corruption.

GPUThor DoS and root privilege escalation risks

The researchers demonstrated that GPUThor can trigger a denial-of-service condition on an ECC-enabled NVIDIA RTX A6000. During testing, the GPU reset approximately every two hours, terminating active workloads.

Repeated attacks against the same card may eventually cause the device to be marked as requiring replacement, according to the researchers.

A more serious attack scenario involves corrupting GPU page tables. The researchers say this could allow an unprivileged CUDA application to obtain arbitrary memory access and potentially open a root shell on the host system.

If confirmed in a targeted environment, this type of GPU memory corruption could undermine workload isolation and create risks for shared AI, cloud, and high-performance computing infrastructure.

How to protect NVIDIA GPUs from GPUThor

In addition to the four vulnerable workstation models, the server-class NVIDIA A100 uses SECDED-level ECC. According to the researchers, this may still allow privilege-escalation attacks, although design limitations make the A100 more resistant to GPUThor-based denial-of-service conditions.

On some Blackwell GPUs, the RAS Repair restore feature can slow GPUThor attacks, but it does not completely prevent them.

The researchers also warn that GPUs using HBM3, HBM3e, or GDDR7 with on-die ECC may remain vulnerable if an attack produces a multi-bit error.

The researchers reported the issue to NVIDIA on April 29. On August 21, NVIDIA published an security advisory with mitigation guidance.

NVIDIA recommends enabling both SYS-ECC and IOMMU/DMA isolation, monitoring GPU error telemetry, and restricting shared access to GPUs running untrusted workloads.

NVIDIA says the risk depends on factors including the DRAM device, memory technology, platform design, in-DRAM protections, and system configuration. The company also noted that researchers did not observe bit flips on GDDR6X or HBM2e GPUs tested with the same attack pattern.

To reduce exposure, organizations should avoid sharing GPUs between tenants whenever possible, monitor ECC error counters, and restrict untrusted CUDA applications. The researchers said future GPUs may require stronger multi-bit ECC protections and additional hardware-level defenses to provide comprehensive protection against GPU Rowhammer attacks.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses can drop sharply.

Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report