GPUThor attack bypasses NVIDIA ECC protections for root access

Researchers at the University of Toronto have disclosed a new Rowhammer-style attack named ‘GPUThor’ that can bypass error-correcting code (ECC) protections on NVIDIA workstation GPUs. The attack enables denial-of-service (DoS) and root-level privilege escalation by inducing bit flips in GDDR6 memory.

Unlike previous GPU Rowhammer attempts that were neutralized by ECC, GPUThor utilizes a non-uniform hammering pattern. By accounting for undocumented GPU behaviors—specifically how memory requests are coalesced and how Target Row Refresh (TRR) mitigations activate—the researchers can bypass defenses. The attack was demonstrated on Ampere-class NVIDIA GPUs, including the RTX A4000, A4500, A5000, and A6000, which are widely used in AI and cloud infrastructure.

To execute the attack, an actor must be able to launch an unprivileged CUDA kernel on the target GPU, such as a co-tenant in a shared cloud environment. Researchers recommend avoiding cross-tenant GPU sharing, monitoring ECC error counters, and restricting untrusted CUDA workloads to mitigate these risks.