Skip to content
Today
Sections

Security Reports disagree2 publishers 3 min read Published Updated

GPUThor: ECC is not a Rowhammer backstop on Ampere GPUs, and root is on the table

University of Toronto researchers cut the hunt for an exploitable bit flip from 21.9 hours to about 1.1 minutes, and logged two errors that ECC repaired incorrectly.

The Watch · Security desk

Send a correction

What happened

  • A Rowhammer attack called GPUThor bypasses ECC on NVIDIA GPUs and reaches both denial of service and root-level privilege escalation.
  • With ECC on, two triple-bit errors were repaired incorrectly by the ECC logic itself, corrupting data.
  • The findings went to NVIDIA on April 29, and the company published guidance in an advisory on August 21.

Why it matters

  • Who's exposed exposure A guest CUDA job on shared Ampere hardware now has to be treated as a candidate for host root, which puts the host boundary in scope rather than just the accelerator.
  • What it limits constraint ECC was the compensating control that made shared GPU capacity sellable; the researchers' own top recommendation is to stop cross-tenant sharing, which is the product.
  • What it costs cost The availability path damages inventory rather than just interrupting it, so the bill lands on whoever owns the cards, not the tenant who lost a job.
  • What doesn't add up contradiction NVIDIA points to clean results on the GDDR6X and HBM2e parts it tested while the researchers say newer on-die ECC memory may still fall to multi-bit flips, so buyers get no clear read on newer fleets.

SECDED does one job well and one job badly. It corrects a single flipped bit in a monitored word and detects two [4]. Three bits in the same word sits outside its design, and the University of Toronto team reached that state: two triple-bit errors that ECC repaired incorrectly, producing corrupted data [19]. The other 387 multi-bit events with ECC enabled were detected but not correctable [18]. So of the 389 multi-bit events logged, roughly 0.5 percent came back wrong and marked clean [22].

That split is the whole argument about model integrity. The 387 are loud; they are what drives the observed denial of service, where an ECC-enabled RTX A6000 resets every two hours and kills every workload on it [8], and eventually flags itself as needing replacement [15]. Twelve resets a day is an availability incident somebody will notice [17]. The two are the ones that matter for a training run or an inference weight, because nothing upstream is told anything went wrong.

The rate work is what makes any of this operational rather than academic. By accounting for how the GPU coalesces repeated memory requests and how often GDDR6 fires Target Row Refresh, both undocumented behaviours, the researchers hammered in a non-uniform pattern below the TRR trigger and produced 6.6 times more aggressor-row activations than their earlier work [5][6]. Without ECC that yielded 72,000 to 377,000 flips per GB on the tested cards [7]. At those rates, an exploitable flip turns up in about 1.1 minutes instead of 21.9 hours [20], a speedup of roughly 1,195 times [21]. Twenty-two hours of hammering is a lab artifact. Sixty-six seconds fits inside a rented session.

The escalation path is page tables. The researchers claim corruption of GPU page tables gives an unprivileged CUDA program arbitrary memory access and a root shell on the host [9]. The demonstrated cards are workstation parts, RTX A4000 through A6000 on GDDR6 [3], but the researchers say privilege escalation should still work on server-class A100 because it relies on the same SECDED-level ECC [10], and that RAS Repair on some Blackwell parts makes the attack slower without preventing it [11].

NVIDIA's advisory, published on 21 August after an April 29 report [12], recommends SYS-ECC plus IOMMU/DMA isolation, error telemetry monitoring, and restricting untrusted workloads [16]. The company also says risk varies by DRAM device and platform, and that no flips were observed on the GDDR6X or HBM2e GPUs it tested with the same patterns [13]. That is not a rebuttal of the GDDR6 result; it is a narrower claim about other memory. The researchers, for their part, say complete protection likely needs multi-bit ECC in future hardware, and until then advise against cross-tenant GPU sharing [14].

Both parties land on watching ECC error counters [16][14]. The counters saw 387 of 389 [22].

What to watch

  • Whether any cloud or colocation provider selling shared Ampere capacity changes its tenancy model or publishes its SYS-ECC and IOMMU configuration for customers to verify.
  • Independent reproduction of the page-table corruption path on server-class A100 hardware, which the researchers assert but did not demonstrate.
  • Whether adapted hammering patterns produce multi-bit flips on GDDR7 or HBM3e parts with on-die ECC, which would move this off Ampere entirely.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence60
Adoption
Not scored
Hype gap+30
Incentives
Not scored
Confidence55
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    A newly disclosed Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial of service and root-level privilege escalation.

    Reported SupportedView cited source
  2. [2]

    GPUThor is described in a paper published by the University of Toronto, and the researchers say it achieves far more practical bit-flip rates than their earlier GPUHammer and GPUBreach concepts, which became irrelevant after ECC was introduced.

    Reported SupportedView cited source
  3. [3]

    The attack was demonstrated against Ampere-class NVIDIA workstation GPUs with GDDR6 memory, including the RTX A4000, RTX A4500, RTX A5000 and RTX A6000, all widely used in AI and cloud infrastructure.

    Reported SupportedView cited source
  4. [4]

    NVIDIA uses mitigations such as SECDED ECC, which corrects single-bit errors and detects double-bit errors within monitored memory blocks.

    Reported SupportedView cited source
  5. [5]

    The researchers adjusted GPUThor so its hammering follows a non-uniform pattern at a rate that avoids activating GDDR6's Target Row Refresh mitigations, by accounting for two undocumented GPU behaviours: how repeated memory requests are coalesced and how frequently TRR activates.

    Reported SupportedView cited source
  6. [6]

    The adjustment generates 6.6 times more aggressor-row activations than previous attack concepts.

    Reported SupportedView cited source
  7. [7]

    GPUThor achieves between 72,000 and 377,000 flips per GB on the tested GPUs with no ECC protections, between 4,548 and 23,597 times higher than the researchers' previous GPUHammer attack, approaching rates of CPU Rowhammer attacks such as Blacksmith.

    Reported SupportedView cited source
  8. [8]

    The researchers showed GPUThor can induce a denial-of-service state on an ECC-enabled RTX A6000, causing the GPU to reset every two hours and terminating all workloads.

    Reported SupportedView cited source
  9. [9]

    The researchers claim privilege escalation to root is possible by corrupting GPU page tables, giving an unprivileged CUDA program arbitrary memory access and opening a root shell on the host system.

    Reported SupportedView cited source
  10. [10]

    The researchers say that despite limitations that improve resilience to denial-of-service conditions, privilege escalation can still work on server-class Ampere GPUs (A100) because they still rely on SECDED-level ECC.

    Reported SupportedView cited source
  11. [11]

    On some Blackwell GPUs the RAS Repair resilience feature makes a GPUThor attack more time consuming but does not prevent it, and the researchers say even HBM3/e and GDDR7 GPUs with on-die ECC might be vulnerable if multi-bit flips are triggered.

    Reported SupportedView cited source
  12. [12]

    The researchers reported their findings to NVIDIA on April 29, and on August 21 the company published an advisory providing guidance.

    Reported SupportedView cited source
  13. [13]

    NVIDIA says risk varies by DRAM device, memory technology, platform design, in-DRAM defenses and system configuration, and that no bit flips were observed on the tested GDDR6X or HBM2e GPUs using the same attack patterns.

    Reported SupportedView cited source
  14. [14]

    The researchers recommend avoiding cross-tenant GPU sharing where possible, monitoring ECC error counters and restricting untrusted CUDA workloads, and say complete protection will likely require stronger multi-bit ECC and hardware-level defenses in future GPUs.

    Reported SupportedView cited source
  15. [15]

    After repeating the attack on the same card, the device will eventually mark itself as requiring replacement.

    Reported SupportedView cited source
  16. [16]

    NVIDIA recommends enabling both SYS-ECC and IOMMU/DMA isolation, monitoring GPU error telemetry, and restricting the sharing or execution of untrusted workloads.

    Reported SupportedView cited source
  17. [17]

    A GPU reset every two hours amounts to about 12 forced resets and workload terminations per day.

    Derived Supported
  18. [18]

    With ECC enabled, GPUThor generated 387 double-bit errors that ECC detects but cannot correct.

    Reported ContestedView cited source
  19. [19]

    With ECC enabled, GPUThor also generated two triple-bit errors, which ECC repaired incorrectly, resulting in data corruption.

    Reported ContestedView cited source
  20. [20]

    At GPUThor bit-flip rates, finding an exploitable bit flip is possible within roughly 1.1 minutes, down from 21.9 hours with GPUHammer.

    Reported ContestedView cited source
  21. [21]

    The drop from 21.9 hours to about 1.1 minutes to find an exploitable bit flip is a speedup of roughly 1,195 times.

    Derived Contested
  22. [22]

    Of the 389 multi-bit events logged with ECC enabled, two, or about 0.5 percent, were silently miscorrected rather than detected.

    Derived Contested

Sources

2 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · August 26, 2026

    New GPUThor attack defeats NVIDIA ECC protection for root access
  2. thehackernews.com

    2 articles · August 27, 2026

    New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access

Topics and entities

Topics

  • Multi-Tenant GPU Isolation

Entities