NVIDIA workstation GPUs fall to GPUThor attack that beats built-in error correction

Key points

• Researchers at the University of Toronto disclosed GPUThor, a Rowhammer attack that bypasses NVIDIA's single-error-correcting ECC on Ampere workstation GPUs.
• Confirmed vulnerable cards include the RTX A4000, A4500, A5000 and A6000, all common in AI and cloud workloads.
• The technique produces 72,000 to 377,000 bit flips per gigabyte with ECC off, finding an exploitable flip in about 1.1 minutes.
• The researchers demonstrated a denial-of-service that forces an RTX A6000 to reset every two hours, and a path to root by corrupting GPU page tables.
• The findings were reported to NVIDIA on April 29, and NVIDIA published an advisory on August 21 recommending SYS-ECC, IOMMU isolation, and tighter workload controls.

A new paper from the University of Toronto describes GPUThor, an attack that pushes NVIDIA graphics cards past the memory safeguards NVIDIA relies on to keep bits from silently flipping. First reported by BleepingComputer, the research shows the attack works on Ampere-class workstation GPUs widely rented out for AI training.

Rowhammer, the underlying technique, is not new. It works by reading the same row of memory over and over until neighbouring rows leak, flipping ones into zeros or the reverse. That corruption can crash a system or, in the wrong hands, hand attackers control.

GPUs sit in a special place in this story. They run AI models, cloud rendering jobs, and shared workloads in data centres. A flipped bit in the wrong place can wreck a training run or give one tenant on a shared server a way into another.

What does GPUThor actually do?

GPUThor tricks the GPU's memory into flipping bits even when error-correcting code, the built-in check that fixes single-bit slip-ups, is switched on. The researchers tuned their hammering pattern to slip past a defence called Target Row Refresh, which normally spots aggressive access and refreshes the memory before damage sets in.

They did this by studying two undocumented behaviours in NVIDIA hardware: how the GPU merges repeated memory requests, and how often Target Row Refresh actually kicks in. The result is 6.6 times more aggressor-row activations than their earlier work.

With ECC off, the team measured between 72,000 and 377,000 flips per gigabyte on the tested cards. That is thousands of times more than GPUHammer, their previous attempt.

With ECC on, GPUThor still produced 387 double-bit errors, which ECC detects but cannot fix, and two triple-bit errors, which ECC quietly "corrected" the wrong way. Silent corruption is the outcome AI operators fear most.

Which GPUs are affected?

NVIDIA notes that no bit flips were observed on GDDR6X or HBM2e cards using the same patterns, but the researchers warn that on-die ECC in newer memory may still fall to multi-bit flips.

How bad is the worst case?

On an RTX A6000 with ECC enabled, GPUThor forced the GPU to reset every two hours, killing every workload on the card. Run the attack often enough and the device flags itself as needing replacement.

The sharper attack targets privilege. By corrupting GPU page tables, the tables that decide which memory a program can touch, the researchers got an ordinary CUDA program to read and write anywhere it liked, then opened a root shell on the host machine. In a shared cloud, that means one customer reaching into another.

What should operators do now?

NVIDIA's advisory recommends enabling both SYS-ECC and IOMMU or DMA isolation, watching GPU error telemetry, and refusing to run untrusted code alongside sensitive workloads. The researchers add one practical rule: avoid cross-tenant GPU sharing where you can.

For everyday users, there is nothing to install. This is a data centre and workstation problem. If you rent GPU time for AI work, ask your provider whether ECC monitoring and IOMMU isolation are on.