Researchers from the University of Toronto have developed GPUThor, a novel memory bit flipping technique that challenges existing security measures for Nvidia GPUs. This method circumventing the error-correcting codes (ECC) used in enterprise-grade hardware can grant root access to the underlying systems, posing significant implications for security, especially within AI and enterprise environments.
GPUThor belongs to a family of attacks known as Rowhammer, which exploit the physical structure of contemporary random access memory (RAM). The foundational Rowhammer attack, first shown in 2015, takes advantage of the close proximity of memory cell rows, which can electrically interact, flipping bits from 0 to 1 and vice versa. This technique, termed row hammering, can be used maliciously to escalate privileges or manipulate AI models.
Prior iterations of Rowhammer attacks have been tailored to various memory systems, including DDR3, DDR4, and even DDR5, which had previously been considered secure. GPUThor is particularly notable as the first Rowhammer assault against Nvidia GPUs capable of breaking ECC defenses. The University of Toronto researchers assert, “Our previous study, GPUHammer (2025), showed how Rowhammer could induce bit flips in GDDR6 memory, with follow-up work, GPUBreach (2026), demonstrating privilege escalation to root access. At that time, enabling ECC was recommended to mitigate such threats.” Historically, prior GPU vulnerabilities were neutralized upon enabling ECC.
Distinction of GPUThor
Unlike its predecessors, GPUHammer and GPUBreach, which employed uniform memory row hammering, GPUThor utilizes a non-uniform approach. This significantly amplifies the effectiveness of the attack, resulting in double and even triple-bit errors—conditions ECC is not equipped to rectify. GPUThor exerts a force of 6.6 times that of earlier GPU attacks, achieving anywhere between 500 to 23,500 times more bit flips.
Moreover, the time required to exploit a bit flip has drastically decreased. With GPUHammer, exploiting a vulnerable spot on an Nvidia RTX A6000 card took approximately 21.9 hours without ECC, whereas GPUThor can accomplish this in just 1.1 minutes on the same hardware.
“We confirmed bit flips on four Nvidia Ampere GPUs featuring GDDR6 memory: RTX A4000, A4500, A5000, and A6000,” the researchers indicated. “These GPUs are prevalent in cloud instances and workstations. The attack methodology is versatile enough that other GPUs with similar memory configurations may also be affected.” Nevertheless, attempts to replicate the attack on Nvidia's A100 and H100 server GPUs, or newer models built upon the Blackwell architecture such as RTX 5090 and RTX 6000, were unsuccessful. These newer variants utilize different memory types, such as HBM, GDDR6X, and GDDR7, which have alternative defenses in place. The research team plans to further investigate these architectures to evaluate potential vulnerabilities.
Significance of the Findings
As AI models increasingly rely on enterprise and server-class GPUs for training and inference tasks, the implications of GPUThor extend beyond mere theoretical risk. In testing, the researchers managed to crash GPU systems so frequently that the GPUs flagged themselves as defective within a day, triggering internal replacement processes via their crash detection systems. This leads not only to denial-of-service conditions but also allows unauthorized elevation of privileges through altered GPU memory page tables.
“When a GPU functions in a time-shared environment, an attacker operating on the same card can potentially manipulate bits in a victim’s data, inducing a crash on the shared GPU,” they explained. “Even with isolated conditions, any untrusted code executing on the GPU—such as ML models pulling dependencies from the internet that may be compromised—allows escalation to root-level access, creating vulnerability to malware infiltration.”
Defense Strategies
Addressing the structural flaw exploited by GPUThor will necessitate enhanced hardware defenses in future GPU iterations. Until such advancements are realized, users should exercise caution with untrusted code running on GPUs and monitor Nvidia’s ECC error-correction counters diligently, as surges in these readings could indicate an attack is underway.
The researchers reported their findings to Nvidia in April, prompting the company's release of a new security advisory. This advisory provides guidance on mitigation strategies, including enabling host IOMMU/DMA isolation and using tools like nvidia-smi or supported out-of-band management interfaces to keep track of ECC telemetry.
