GPUThor breaks the error correction Nvidia recommended against Rowhammer

GPUThor Breaks Nvidia’s Recommended Error Correction for Rowhammer

University of Toronto researchers have introduced GPUThor, the first Rowhammer attack to bypass error correction (ECC) on Nvidia GPUs. This new technique successfully targets four Ampere generation workstation cards: RTX A4000, A4500, A5000, and A6000, transforming unprivileged CUDA programs into root shells with ECC enabled.

Nvidia’s Prior Recommendation and New Findings:

Last year, Nvidia advised GPU owners concerned about Rowhammer to enable ECC. However, researchers from the University of Toronto have demonstrated a more powerful Rowhammer attack that circumvents ECC.

How GPUThor Works:

• GPUThor builds upon previous GPU-based Rowhammer attacks, such as GPUHammer (2025) and GPUBreach (2026), but with enhanced intensity.

• The attack utilizes unique reverse-engineered techniques to overcome two key challenges:

  1. Merger of Repeated Requests: GPU memory systems merge repeated requests to the same address, but GPUThor finds a way to maintain distinct hits from different warps to different cache lines within the same row.

  2. Timing of Target Row Refresh: The team discovered that Target Row Refresh on Ampere GDDR6 fires at a rate of roughly one interval every 72 refreshes, allowing for synchronized patterns that reproduce reliably.

Results:

• GPUThor exhibits 6.6 times the hammering intensity of prior GPU attacks, resulting in 500 to 23,500 times more bit flips.

• On the A5000 with ECC disabled, GPUThor achieved 377,000 bit flips per gigabyte.

• Compared to the strongest CPU attack (Blacksmith), GPUThor is 500 to 23,500 times more effective.

• The researchers observed 387 double-bit errors and two triple-bit errors that ECC detected but could not correct.

Timeline and Disclosure:

• The GPUThor research paper was published on August 25th, 2026.

• Nvidia issued a security notice on August 21st, 2026.

• The exploit code will be publicly available on November 15th, 2026.

Conclusion:

Since a patch is not feasible without hardware changes, this discovery highlights the evolving landscape of cybersecurity threats and the ongoing need for robust and adaptable security measures.