A New Rowhammer Attack Exposes NVIDIA GPUs to Root Access Vulnerability
In a disturbing revelation, University of Toronto researchers have disclosed a new attack called GPUThor that can bypass error-correcting code (ECC) protections on NVIDIA’s high-end graphics processing units (GPUs). This devastating attack enables denial-of-service (DoS) and root-level privilege escalation, posing a significant threat to AI model training infrastructure and cloud-based services.
GPUThor is a type of Rowhammer attack that exploits vulnerabilities in the way memory rows are accessed. By repeatedly accessing adjacent memory regions at an alarming rate, the attackers can induce bit-flips that corrupt data and compromise security. NVIDIA has implemented various mitigations, including SECDED ECC, to prevent such attacks, but GPUThor’s unique approach allows it to evade these defenses.
The researchers claim that their attack is more practical than previous concepts like GPUHammer or GPUBreach. By understanding undocumented GPU behaviors, they adjusted the hammering pattern to avoid activating Target Row Refresh (TRR) mitigations. This adjustment enables GPUThor to generate an astonishing 6.6 times more aggressor-row activations and achieve bit-flip rates that are thousands of times higher than its predecessors.
The researchers demonstrated the attack’s effectiveness on NVIDIA’s Ampere-class workstation GPUs, including the RTX A4000, RTX A4500, RTX A5000, and RTX A6000. They showed that GPUThor can induce a DoS state on an ECC-enabled RTX A6000, causing the GPU to reset every two hours and terminating all workloads. Moreover, by corrupting GPU page tables, they claimed it is possible to escalate privileges to root level, giving unprivileged CUDA programs arbitrary memory access and opening a root shell on the host system.
While NVIDIA has published an advisory providing guidance on mitigating this vulnerability, the researchers emphasize that complete protection will likely require stronger multi-bit ECC and hardware-level defenses in future GPUs. In the meantime, users are advised to enable both SYS-ECC and IOMMU/DMA isolation, monitor GPU error telemetry, and restrict untrusted workloads.
The risk of a successful Rowhammer attack is not limited to NVIDIA’s high-end GPUs; even HBM3/e and GDDR7 devices with on-die ECC might be vulnerable if multi-bit flips are triggered. Therefore, users should take immediate action to secure their AI model training infrastructure and cloud-based services by following the recommended mitigations.
To protect against GPUThor and similar attacks, it is crucial to monitor ECC error counters, restrict untrusted CUDA workloads, and avoid cross-tenant GPU sharing where possible. By taking proactive measures to address this vulnerability, users can prevent potential data corruption and security breaches that could have devastating consequences for their organizations.
Source: Bleeping Computer — 2026-08-26