New GPUThor Attack Bypasses NVIDIA GPU ECC Protection for Root Access

How GPUThor Evades ECC and TRR Protections

NVIDIA's GDDR6 memory uses SECDED ECC to correct single-bit errors and detect double-bit errors. Researchers found that GPUThor avoids triggering the target row refresh (TRR) mechanism by using a non-uniform hammering pattern. This approach analyzes how memory requests are grouped and how often TRR activates. By adjusting the hammering pattern, they achieved up to 6.6 times more aggressive row activations compared to prior attacks like GPUHammer or GPUBreach.

Bit Flip Rates on Ampere GPUs Without ECC

On Ampere-class GPUs including RTX A4000, RTX A4500, RTX A5000, and RTX A6000—widely used in AI and cloud infrastructures—the attack produced between 72,000 and 377,000 bit flips per gigabyte without ECC. These values are 4,548 to 23,597 times higher than those seen in the earlier GPUHammer attack. They approach bit flip rates observed in potent CPU-based Rowhammer attacks such as Blacksmith. Due to this efficiency, an exploitable bit flip can be found on average in about 1.1 minutes, a drastic reduction from the 21.9 hours required by GPUHammer.

Impact of GPUThor With ECC Enabled

Even with ECC active, GPUThor caused significant effects. On an RTX A6000 with ECC enabled, researchers observed 387 double-bit errors (detected but not corrected by ECC) and two three-bit errors, which ECC incorrectly corrected, leading to data corruption. The attack also induced a denial-of-service state: the GPU automatically reset every two hours, interrupting all active workloads. Repeated attacks on the same GPU eventually led to the device being flagged for automatic replacement.

Path to Root-Level Privilege Escalation

Although the original description was cut off, researchers stated that GPUThor enables root-level privilege escalation. This is possible by exploiting the memory corruption generated by the attack to modify critical system memory regions. Achieving such modification opens the path to full device control. This makes GPUThor a serious threat not only to system stability but also to the security of high-performance computing environments, especially in AI model training where data integrity is essential.