GPUThor Attack Defeats ECC Protection on Nvidia AI GPUs

Researchers at the University of Toronto disclosed a new attack technique called GPUThor in late August, capable of bypassing the ECC (error-correcting code) memory protection built into Nvidia GPUs. The method, based on the Rowhammer principle, was verified on Ampere-architecture workstation GPUs with GDDR6 memory — the RTX A4000, A4500, A5000 and A6000 — models widely deployed in AI and cloud infrastructure. The team reported the flaw to Nvidia on April 29, and the company published mitigation guidance on August 25, after roughly four months of coordinated disclosure.

Why ECC is essential on an AI GPU

Memory chips under sustained load can randomly suffer a 'bit flip': a bit stored as 0 accidentally switches to 1, or vice versa, due to cosmic rays, electrical interference, or manufacturing defects. For everyday computing, an isolated bit flip often goes unnoticed. But for AI training or inference, it can directly corrupt weights, gradients, or activation values — silently skewing a training run, or producing a plausible-looking but wrong answer at inference time, with no warning at all. That is exactly what ECC exists to prevent: by storing an extra check code alongside each memory block, the system automatically corrects single-bit errors and detects double-bit errors, a scheme known as SECDED. It is this guarantee that lets cloud providers confidently let multiple customers share the same physical GPU.

How GPUThor breaks through ECC

GPUThor deliberately hammers memory in a non-uniform pattern, while exploiting two GPU behaviors Nvidia had never documented: how the chip coalesces repeated memory-access requests, and how often GDDR6's Target Row Refresh (TRR) mitigation actually triggers. By staying just under TRR's detection threshold, GPUThor can keep hammering a target memory row continuously, forcing bit flips in neighboring rows.

• On tested GPUs with ECC disabled, GPUThor produced between 72,000 and 377,000 bit flips per gigabyte of memory — up to 23,597 times more than the team's earlier GPUHammer attack.
• Even with ECC enabled, GPUThor generated 387 double-bit errors (which ECC can detect but not correct) and two triple-bit errors, which exceed ECC's correction capability and caused data corruption.
• Finding an exploitable bit flip now takes roughly 1.1 minutes on average, down from 21.9 hours with GPUHammer.
• A sustained attack on an ECC-enabled RTX A6000 can force the GPU to reset every two hours, halting all running workloads; repeated attacks can eventually cause the card to flag itself as needing replacement.

Beyond denial of service, the researchers demonstrated a more serious outcome: by corrupting the GPU's page tables, an unprivileged CUDA program can gain arbitrary memory access and open a root shell on the host machine — turning an ordinary GPU compute job into full control of the server. Data-center-class Ampere GPUs such as the A100 are more resilient to denial-of-service but remain vulnerable to privilege escalation; even Blackwell-generation GPUs with RAS Repair protection only make the attack take longer, not impossible. The researchers warn that future GDDR7 or HBM3e GPUs with on-die ECC could still be vulnerable under multi-bit-flip conditions.

Who is actually exposed

GPUThor targets the data-center GPU clusters that power AI training and inference, particularly multi-tenant cloud GPU instances — the default model for most public-cloud GPU offerings, where several customers share one physical card. An attacker who rents even a small slice of compute time could disrupt, or even corrupt, another tenant's training or inference job running on the same hardware — a supply-chain-style risk that is invisible from the application layer. Nvidia's guidance focuses on isolation and monitoring: enable SYS-ECC and IOMMU/DMA isolation, continuously monitor GPU error telemetry, and restrict sharing of untrusted CUDA workloads on the same hardware.

What this means for companies running GPU infrastructure

For enterprises that rent GPU compute from AWS, Microsoft Azure, Google Cloud, or any smaller GPU cloud provider to train or run AI models, GPUThor is a reminder that the physical GPU behind an API call is rarely dedicated hardware — it is very often shared with other tenants. Before treating a GPU cloud instance as a trusted, isolated environment, security and infrastructure teams should confirm with their provider whether SYS-ECC and IOMMU/DMA isolation, as recommended by Nvidia, are actually enabled, ask for visibility into GPU error telemetry, and add multi-tenant GPU isolation to vendor security reviews — not as a checkbox on a spec sheet, but as a real question about how a shared card is protected.