www.it-connect.fr
GPUThor: The Rowhammer Attack That Breaks NVIDIA GPU ECC
A GPU that reboots every two hours, and root access to the host machine via a terminal. That is what GPUThor is all about: a Rowhammer attack discovered by researchers at the University of Toronto, capable of bypassing the ECC protections of several NVIDIA GPUs. Here is what you need to know.
Rowhammer is that physical DRAM flaw known since 2014: hammering the same memory row creates electrical interference that flips bits in neighboring rows, without needing direct access to them. Initially limited to DDR memory in CPUs, the phenomenon has now reached graphics cards, as shown by the GPUBreach attack targeting the GDDR6 memory of NVIDIA GPUs.
Until now, the main protection was ECC, or error correction. That was enough to stop GPUBreach as well as GPUHammer. But GPUThor changes the game: ECC is not enough. Researchers at the University of Toronto managed to trigger this attack on NVIDIA Ampere GPUs, including the RTX A4000, RTX A4500, and RTX A6000. Authored by Chris S. Lin, Joyce Qu, Aditya Rajeev, and Gururaj Saileshwar, this research will be presented at ACM CCS 2026 in The Hague in November.
DRAM chips include a defense mechanism called Target Row Refresh (TRR). It detects memory rows that are being accessed too heavily and proactively refreshes neighboring rows, which cancels out the hammering effect. To fool it, attacks flood the real target row with decoy rows so that TRR focuses on rows that are not actually targeted. The problem is that until now, GPU attacks treated the target and the decoys the same way. The real target therefore received only a "small share of the hits".
GPUThor takes a different approach: the hammering is concentrated on the targeted row, with just enough decoys to remain invisible. That was easier said than done. Through reverse engineering, the researchers identified two undocumented behaviors that stood in the way, one on the GPU side and one on the memory chip side.
- Access coalescing. The GPU groups repeated accesses to the same address into a single memory operation, which completely reduces hammering. The researchers found the flaw: accesses issued by different thread groups (warps) to different cache lines escape coalescing. All they had to do was distribute them.
- The defense timing. It was assumed that TRR intervened at every memory refresh cycle. In reality, on the chips tested, it happens about once every 72 cycles. Knowing this rhythm makes it possible to align the attack pattern with it, and therefore trigger flips reproducibly.
With that understanding, the researchers were able to adapt their method. The result: 6.6 times more hammering on the targeted row, and far more bit flips overall: 0s turning into 1s, or the other way around, without anyone asking for it. Across four Ampere cards with GDDR6 (RTX A4000, A4500, A5000, and A6000), the researchers counted 72,000 to 377,000 flips per gigabyte of memory with ECC disabled. Depending on the model, that is 4,548 to 23,597 times more than with GPUHammer, the first attack of this kind, published by the same team in 2025.
And the number matters. The more bits flip in bulk, the more likely an attacker is to find one in just the right place. On an RTX A6000, finding a truly exploitable bit took 21.9 hours with GPUHammer. With GPUThor, it takes 1.1 minutes. A huge leap forward.
ECC Enabled, Yet Still: Denial of Service and Root Access
Let us recall NVIDIA's error-correcting code, SECDED. On a 16-byte block, it repairs one flipped bit, detects a second one without being able to correct it, and beyond that becomes blind. Everything therefore depends on a bet: that no three bits will ever flip in the same place. A matter of probability.
In the case of GPUThor, the researchers identified 387 two-bit cases, detected but uncorrectable. And two three-bit cases, where SECDED sees nothing unusual: it thinks it is dealing with a single faulty bit, corrects the wrong value, and reports success. No alert, while the data is silently corrupted.
In practice, on a machine equipped with a graphics card with ECC enabled, the researchers managed to trigger:
- Denial of service. On an RTX A6000, GPUThor causes the GPU to reboot roughly every two hours, killing all ongoing workloads in the process. Within a day, the card exhausts its defective row remapping capacity and flags itself as fit for RMA.
- Privilege escalation. By corrupting the GPU page tables, an unprivileged CUDA program gains arbitrary memory access, then a root shell on the host. A first for a GPU protected by ECC, according to the researchers.
On the other memory types tested, GDDR6X, HBM2e, and GDDR7, no bit flips were observed, which NVIDIA also confirmed. However, the researchers remain cautious: nothing says that another attack pattern would not succeed. That may be the next discovery from the same researchers...
Finally, note that the GPUThor flaw was reported to NVIDIA on April 29, 2026, as well as to Google, Microsoft, and AWS. For its part, NVIDIA published a security bulletin on August 21, 2026. The U.S. giant mentions protective measures (keeping ECC enabled, monitoring error telemetry, restricting the execution of suspicious programs, and so on) and the need to apply defense-in-depth principles.
Find more information on gputhor.com.
