Hardware security researchers from the University of Toronto have developed a memory attack technique that defeats the error-correcting code protection on enterprise Nvidia GPUs and can grant root access to the underlying system. The new method, called GPUThor, represents a significant advancement over earlier GPU memory attacks and works by flipping multiple memory bits simultaneously—a condition that built-in safeguards weren't designed to handle. The technique exploits the dense cell structure of modern graphics memory chips and produces triple-bit errors that overwhelm Nvidia's defenses.
GPUThor hammers its target 6.6 times harder than previous GPU attacks and generates 500 to 23,500 times more bit flips, according to the research team. The attack dramatically reduces the time needed to find an exploitable bit flip—from 21.9 hours on an Nvidia RTX A6000 card without ECC enabled using the older GPUHammer method to just 1.1 minute with GPUThor on the same hardware. The researchers confirmed bit flips on four different Nvidia Ampere GPUs with GDDR6 memory: the RTX A4000, A4500, A5000, and A6000, which are common in workstations and cloud instances. However, the attack did not produce bit flips on Nvidia server GPUs such as A100 and H100 or newer Blackwell architecture cards like RTX 5090 or RTX 6000, because these use different memory types such as HBM, GDDR6X, and GDDR7 with alternative defenses.
"GPUThor is the first Rowhammer attack on Nvidia GPUs to break through error-correcting codes (ECC), Nvidia's defense against this threat," the researchers state on their website. The team notes that prior GPU attacks are defeated once ECC is enabled, but GPUThor circumvents this mitigation through non-uniform row hammering that produces double- and triple-bit errors simultaneously. In their tests, the researchers managed to crash GPUs so frequently that within one day the cards flagged themselves as defective and due for replacement using their internal crash detection systems.
The attack matters because enterprise and server-class GPUs typically run sensitive workloads, often from multiple virtual machines simultaneously, and are essential for training, fine-tuning, and running AI models. When a GPU is time-shared between users—common in cloud AI services—an attacker running on the same card can flip bits in a victim's data and crash the shared GPU, the researchers explain. Even when GPUs aren't time-shared, any untrusted code running on the cards, such as machine learning models requiring packages downloaded from the internet that may have been compromised, can escalate to root-level privileges and serve as an entry point for malware. The attack exploits a design flaw in the memory architecture, where tightly packed rows of memory cells leak electrical charges to adjacent rows through rapid and repeated read operations, intentionally flipping stored bit values in a controlled manner.
Because the vulnerability stems from a design flaw, a complete fix requires improved hardware defenses built into future GPU generations, according to the report. Until then, users should exercise caution when running untrusted code on their GPUs and should monitor Nvidia's error-correction counters, since a spike could indicate an attack in progress. GPUThor was reported to Nvidia in April, and the company issued a new security advisory this week with additional recommendations including enabling host IOMMU/DMA isolation where supported and using the nvidia-smi tool or supported out-of-band management interfaces to monitor the ECC telemetry of the cards. The research team plans to investigate newer memory types in the future and doesn't rule out the possibility that alternative attack patterns could exist for them. Organizations relying on shared GPU infrastructure for artificial intelligence workloads face a choice between operational convenience and isolation, while hardware vendors will need to balance memory density gains against the physical vulnerabilities those improvements create.