A newly disclosed hardware attack named GPUThor targets NVIDIA GPUs by exploiting Rowhammer-style bit-flip vulnerabilities to bypass Error-Correcting Code (ECC) memory protections. The attack can enable denial-of-service (DoS) conditions as well as root-level privilege escalation on affected systems. ECC is typically considered a robust defense against Rowhammer attacks in DRAM, but GPUThor demonstrates it can be defeated in GPU memory contexts. This represents a significant threat to cloud and high-performance computing environments where NVIDIA GPUs are widely deployed. The attack highlights the growing security risks associated with GPU hardware, which is increasingly used in sensitive workloads including AI and cryptographic operations. Successful exploitation could allow an attacker to gain elevated privileges or destabilize GPU-dependent systems.
GPUThor is a new Rowhammer-class attack developed by University of Toronto researchers that bypasses NVIDIA GPU ECC (Error-Correcting Code) protections on GDDR6 memory. The attack works by hammering memory rows in a non-uniform pattern at a rate specifically tuned to avoid triggering GDDR6's Target Row Refresh (TRR) mitigations. It exploits two undocumented GPU behaviors: how repeated memory requests are coalesced and how frequently TRR activates. GPUThor achieves 6.6x more aggressor-row activations than previous attacks, generating between 72,000 and 377,000 bit flips per GB (without ECC), which is 4,548 to 23,597 times higher than the predecessor GPUHammer. An exploitable bit flip can be found in approximately 1.1 minutes versus 21.9 hours with GPUHammer. With ECC enabled, GPUThor generated 387 double-bit errors (detected but uncorrectable by ECC) and 2 triple-bit errors that ECC repaired incorrectly, causing data corruption. Attack impacts include: (1) Denial-of-Service — causing an ECC-enabled RTX A6000 to reset every two hours until the device marks itself for replacement; (2) Privilege Escalation — corrupting GPU page tables to give an unprivileged CUDA program arbitrary memory access and open a root shell on the host system. The attack also affects server-class Ampere A100 GPUs for privilege escalation, and Blackwell GPUs with RAS Repair are slowed but not immune. HBM3/e and GDDR7 GPUs with on-die ECC may also be vulnerable if multi-bit flips are triggered. No bit flips were observed on GDDR6X or HBM2e GPUs using the same patterns.
NVIDIA Recommendations: 1) Enable both SYS-ECC and IOMMU/DMA isolation on affected GPUs. 2) Monitor GPU error telemetry for anomalous ECC error counts. 3) Restrict the sharing or execution of untrusted workloads on GPU hardware. Researcher Recommendations: 1) Avoid cross-tenant GPU sharing where possible, especially in cloud and AI infrastructure environments. 2) Monitor ECC error counters continuously for signs of double-bit or triple-bit errors. 3) Restrict untrusted CUDA workloads from accessing GPU resources. 4) Note that complete protection will likely require stronger multi-bit ECC and hardware-level defenses in future GPU generations. 5) Organizations using NVIDIA Ampere workstation GPUs (RTX A4000, A4500, A5000, A6000) and A100 server GPUs in AI/cloud environments should treat this as a high-priority risk, especially in multi-tenant deployments.
