GPUThor attack breaches Nvidia GPU defenses

Hardware security researchers at the University of Toronto have developed a new memory bit-flipping technique that can overcome the error-correcting codes (ECC) protection built into enterprise Nvidia GPUs. The attack, named GPUThor, can lead to root access on the underlying system, raising serious concerns for cloud providers and AI workloads that rely on GPU isolation.

Breaking past ECC

GPUThor belongs to a class of attacks known as Rowhammer, which exploits the high density of modern RAM chips. The original Rowhammer attack, demonstrated in 2015 on DDR3 and DDR4 memory, relies on the fact that tightly packed rows of memory cells can leak electrical charge to adjacent rows, causing bit values to flip.

By repeatedly and rapidly reading the same memory row—a technique called row hammering—attackers can intentionally trigger these bit flips. If controlled, such flips can have severe security implications, ranging from privilege escalation to AI model manipulation.

Over the years, researchers have developed numerous Rowhammer variations targeting different memory types, from DDR3 and DDR4 to DDR5—which was initially thought to be resistant—and to the GDDR chips used in graphics cards. GPUThor is the first to break through ECC on Nvidia GPUs, defeating the company's primary defense against this threat.

“GPUThor is the first Rowhammer attack on Nvidia GPUs to break through error-correcting codes (ECC), Nvidia’s defense against this threat.”

— the University of Toronto research team

A harder hammer

The key innovation of GPUThor is non-uniform row hammering, a departure from previous attacks like GPUHammer and GPUBreach, which hammered memory rows uniformly. Uniform hammering allowed the Target Row Refresh (TRR) mechanism, present in DDR5 and later RAM generations, to detect single-bit flips, and ECC could then correct them.

GPUThor's non-uniform approach produces double- and even triple-bit errors, where multiple bits flip at the same time—a condition ECC was not designed to handle. This means the attack can bypass both TRR and ECC defenses, making it significantly more effective.

According to the researchers, GPUThor hammers its target 6.6 times harder than prior GPU attacks and produces 500 to 23,500 times more bit flips. This also drastically reduces the time needed to find an exploitable bit flip, as not all value flips occur in memory areas mapped for sensitive operations.

Dramatic speed improvement

The efficiency gains are stark. GPUHammer required 21.9 hours to find a usable bit flip on an Nvidia RTX A6000 card with ECC disabled. GPUThor accomplishes the same in just 1.1 minute on the same card.

The researchers confirmed bit flips on four different Nvidia Ampere GPUs with GDDR6 memory: the RTX A4000, A4500, A5000, and A6000. These GPUs are common in workstations and cloud instances, making them attractive targets.

However, the attack did not produce bit flips on Nvidia server GPUs like A100 and H100, nor on newer Blackwell architecture GPUs like the RTX 5090 or RTX 6000. These cards use different or newer memory types, such as HBM, GDDR6X, and GDDR7, which have different defenses. The team plans to investigate these chips in the future, not ruling out alternative attack patterns.

Real-world impact

The stakes are high for enterprise and cloud environments. These GPUs are essential for training and running AI models, and they often handle sensitive workloads from multiple virtual machines simultaneously.

In their tests, the researchers crashed GPUs so frequently that within one day, the cards' internal crash detection mechanisms flagged them as defective and due for replacement. Beyond denial-of-service conditions that kill all running workloads, the researchers managed to corrupt the GPU's memory page tables, allowing an unprivileged program to escalate to root privileges.

This poses a significant risk in cloud AI services, where GPUs are time-shared among users. An attacker on the same card could flip bits in a victim's data or crash the shared GPU, disrupting services for all users.

Mitigation steps

Because GPUThor exploits a design flaw, a complete fix requires better hardware defenses in future GPU generations. Until then, users should be cautious about running untrusted code on their GPUs and should monitor Nvidia's error-correction counters for spikes, which could indicate an attack in progress.

The researchers reported GPUThor to Nvidia in April, and the company issued a security advisory this week. The advisory recommends enabling host IOMMU/DMA isolation where supported and using the nvidia-smi tool or supported out-of-band management interfaces to monitor ECC telemetry.

What this means for you

For cloud providers and enterprises running AI workloads, GPUThor highlights a growing threat to hardware-level isolation. As GPUs become more integral to computing, the risk of Rowhammer attacks that bypass ECC could undermine trust in these platforms. The fact that the attack works on common GPUs like the RTX A6000 suggests that many current cloud instances may be vulnerable, and the only immediate recourse is careful monitoring and restricting untrusted code execution.