NVIDIA workstation GPUs fall to GPUThor attack that beats built-in error correction

Key points

• Researchers at the University of Toronto disclosed GPUThor, a Rowhammer attack that bypasses NVIDIA's single-error-correcting ECC on Ampere workstation GPUs.
• Confirmed vulnerable cards include the RTX A4000, A4500, A5000 and A6000, all common in AI and cloud workloads.
• With ECC disabled, the technique produces between 72,000 and 377,000 bit flips per gigabyte, reaching an exploitable flip in about 1.1 minutes.
• An attacker can force an RTX A6000 to reset every two hours or corrupt GPU page tables to open a root shell on the host machine.
• NVIDIA published an advisory on August 21 recommending SYS-ECC, IOMMU isolation, and tighter workload controls after receiving the report on April 29.

A new University of Toronto paper describes GPUThor, an attack that pushes NVIDIA graphics cards past the memory safeguards meant to keep bits from silently flipping. First reported by BleepingComputer, it works against Ampere-class workstation GPUs widely rented out for AI training. NVIDIA published its patch guidance the day before we reported on a separate critical-rated NVIDIA flaw, making this a dense week for the company's security team.

Rowhammer isn't new. It works by reading the same memory row repeatedly until neighbouring rows leak, flipping ones into zeros or the reverse. That corruption can crash a system or, in the right hands, hand attackers control.

GPUs occupy a particular place in this story. They run AI models and shared workloads in data centres. A flipped bit in the wrong place can wreck a training run or give one tenant on a shared server a way into another.

What does GPUThor actually do?

GPUThor tricks the GPU's memory into flipping bits even when error-correcting code (ECC), the built-in check that fixes single-bit slip-ups, is switched on. The researchers tuned their hammering pattern to slip past Target Row Refresh, a defence that normally spots aggressive memory access and refreshes affected rows before damage sets in.

They did this by studying two undocumented behaviours in NVIDIA hardware: how the GPU merges repeated memory requests, and how often Target Row Refresh actually fires. The result is 6.6 times more aggressor-row activations than their earlier work and bit-flip rates between 4,548 and 23,597 times higher than GPUHammer, their previous attempt.

With ECC on, GPUThor still produced 387 double-bit errors, which ECC detects but can't fix, and two triple-bit errors that ECC "corrected" the wrong way. Silent corruption is what AI operators fear most.

Which GPUs are affected?

NVIDIA notes that no bit flips were observed on GDDR6X or HBM2e cards using the same patterns, but the researchers warn that on-die ECC in newer memory may still fall to multi-bit flips.

How bad is the worst case?

On an RTX A6000 with ECC enabled, GPUThor forced the GPU to reset every two hours, killing every workload on the card. Repeat the attack long enough and the device flags itself as needing replacement.

The sharper attack targets privilege. By corrupting GPU page tables, the structures that decide which memory a program can touch, the researchers got an ordinary CUDA program to read and write anywhere it liked, then opened a root shell on the host machine. In a shared cloud environment, that's one customer reaching into another's workload.

What should operators do now?

NVIDIA's advisory recommends enabling both SYS-ECC and IOMMU or DMA isolation, watching GPU error telemetry, and refusing to run untrusted code alongside sensitive workloads. The researchers add one practical rule: avoid cross-tenant GPU sharing where possible.

For everyday users, there's nothing to install. This is a data centre and workstation problem. If you rent GPU time for AI work, ask your provider whether ECC monitoring and IOMMU isolation are actually on.