A newly disclosed Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial-of-service (DoS) and root-level privilege escalation.
In a paper published by the University of Toronto, researchers say that GPUThor achieves far more practical bit-flip rates than past concepts like their own GPUHammer or GPUBreach, which became irrelevant after ECC was introduced.
The attack was demonstrated against Ampere-class NVIDIA workstation GPUs with GDDR6 memory, including the RTX A4000, RTX A4500, RTX A5000, and RTX A6000, all widely used in AI and cloud infrastructure.
GPUThor attack improvement
Rowhammer is the name for a class of attacks where memory rows are repeatedly accessed (“hammered”) in a way that increases the likelihood of bits in neighboring memory regions to flip, changing their state from one to zero or vice versa.
This can lead to data corruption and security risks. Since AI model training relies heavily on GPU power, a successful Rowhammer attack could have a devastating impact on the model's accuracy.
To mitigate risks from this type of attack, NVIDIA uses mitigations such as SECDED ECC to correct single-bit errors and detect double-bit errors within monitored memory blocks.
However, University of Toronto researchers adjusted GPUThor so its hammering follows a non-uniform pattern at a rate that avoids activating GDDR6’s Target Row Refresh (TRR) mitigations.
They did so by accounting for two undocumented GPU behaviors: how repeated memory requests are coalesced and how frequently TRR activates.
The researchers say that compared to previous attack concepts, the adjustment leads to generating 6.6 times more aggressor-row activations and achieves between 72,000 and 377,000 flips per GB on the tested GPUs with no ECC protections.
These results are between 4,548 and 23,597 times higher than GPUHammer, the researchers’ previous attack, and approach the bit-flip rates achieved by powerful CPU Rowhammer attacks like Blacksmith.
At GPUThor bit-flip rates, finding an exploitable bit flip is possible within roughly 1.1 minutes, down from 21.9 hours with GPUHammer.
The researchers explain that with ECC enabled, GPUThor generated 387 double-bit errors that ECC detects but cannot correct, and two triple-bit errors, which ECC repaired incorrectly, resulting in data corruption.
DoS and privilege escalation
University of Toronto researchers showed that GPUThor can induce a DoS state on an ECC-enabled RTX A6000, causing the GPU to reset every two hours and terminating all workloads.
After repeating the attack on the same card, the device will eventually mark itself as requiring replacement.
The more interesting attack is escalating privileges to root level, which the researchers claim is possible by corrupting GPU page tables, giving an unprivileged CUDA program arbitrary memory access and opening a root shell on the host system.
How to defend against the attack
Beyond the four models confirmed to be vulnerable to GPUThor, the researchers say that despite limitations that improve resilience to denial-of-service (DoS) conditions, privilege escalation can still work on server-class Ampere GPUs (A100) because they still rely on SECDED-level ECC.
In the case of some Blackwell GPUs, the RAS Repair resilience feature makes a GPUThor attack more time consuming but does not prevent it.
According to the researchers' GPUThor paper published yesterday, even HBM3/e and GDDR7 GPUs with on-die ECC might be vulnerable if multi-bit flips are triggered.
The researchers reported their findings to NVIDIA on April 29, and on August 21, the company published an advisory providing guidance.
NVIDIA recommends enabling both SYS-ECC and IOMMU/DMA isolation, monitoring GPU error telemetry, and restricting the sharing or execution of untrusted workloads.
The company says the risk varies by DRAM device, memory technology, platform design, in-DRAM defenses, and system configuration, noting that no bit flips were observed on the tested GDDR6X or HBM2e GPUs using the same attack patterns.
The researchers recommend avoiding cross-tenant GPU sharing where possible, monitoring ECC error counters, and restricting untrusted CUDA workloads. They added that complete protection will likely require stronger multi-bit ECC and hardware-level defenses in future GPUs.
#
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.