{"id":9251,"date":"2026-08-28T18:46:28","date_gmt":"2026-08-28T18:46:28","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9251"},"modified":"2026-08-28T18:46:28","modified_gmt":"2026-08-28T18:46:28","slug":"gputhor-hardware-attack-can-root-nvidia-gpu-systems","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9251","title":{"rendered":"GPUThor hardware attack can root Nvidia GPU systems"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Hardware security researchers from University of Toronto have developed a new memory bit flipping technique that significantly improves on previously known attacks against GPU memory. The new method can defeat the error-correcting codes (ECC) defense used on enterprise Nvidia GPUs and can lead to root access on the underlying system.<\/p>\n

Dubbed GPUThor, the technique falls in a category of attacks known as Rowhammer<\/a> that exploits the cell density of modern random access memory (RAM) chips. The original Rowhammer attack was demonstrated against DDR3 and DDR4 chips back in 2015 and relies on an older observation that tightly packed rows of memory cells can sometimes leak electrical charges to adjacent rows, flipping the stored bit values in those cells from 0 to 1 or the other way around.<\/p>\n

These bit flips can be triggered intentionally using rapid and repeated read operations on the same memory row \u2014 a technique dubbed row hammering \u2014 and if done in a controlled manner, they can have security implications, from privilege escalation to AI model manipulation<\/a>.<\/p>\n

Over the years researchers have developed many variations of Rowhammer attacks<\/a> against different types of memory, from DDR3 and DDR4 to DDR5<\/a>, which was initially thought to be safe, and to the GDDR chips used in graphics cards.<\/p>\n

\u201cGPUThor is the first Rowhammer attack on Nvidia GPUs to break through error-correcting codes (ECC), Nvidia\u2019s defense against this threat,\u201d the U of Toronto team of researchers say on a website dedicated to their new research<\/a>. \u201cOur previous work, GPUHammer<\/a> (2025), first demonstrated Rowhammer bit flips in the GDDR6 memory of Nvidia GPUs, and follow-up work, GPUBreach<\/a> (2026) showed the privilege escalation all the way to root shell on the CPU. At that time, Nvidia recommended enabling ECC as a mitigation (Nvidia Security Notice<\/a>, 2025). All prior GPU attacks are defeated once ECC is enabled.\u201d<\/p>\n

How is GPUThor different?<\/h2>\n

The previous GPUHammer and GPUBreach attacks performed the hammering of memory rows uniformly, which meant that the Target Row Refresh (TRR) mechanism present in DDR5 and later RAM generations can detect the single-bit flips, and then the ECC mechanism, if enabled, can correct them.<\/p>\n

The GPUThor technique enables the first practical non-uniform row hammering on GPU DRAM and as a consequence produces double- and even triple-bit errors, where multiple bits are flipped at the same time, a condition the built-in ECC mechanism was not designed to handle. GPUThor hammers its target 6.6 times harder than prior GPU attacks and produces 500 to 23,500 times more bit flips.<\/p>\n

This also reduces the time for finding an exploitable bit flip, given that not all value flips are in memory areas mapped by the OS for sensitive operations. GPUHammer needs 21.9 hours on an Nvidia RTX A6000 card where ECC is not enabled, compared to just 1.1 minute with GPUThor on the same card.<\/p>\n

\u201cWe confirmed bit flips on four different Nvidia Ampere GPUs with GDDR6 memory: the RTX A4000, A4500, A5000, and A6000,\u201d the researchers said. \u201cThese are common in workstations and cloud instances. The attack technique is general, so other GPUs using similar memory and defenses may also be at risk.\u201d<\/p>\n

However, the researchers also tested Nvidia server GPUs such as A100 and H100 or newer GPUs on the Blackwell architecture like RTX 5090 or RTX 6000, and their attack did not produce bit flips. This is because these cards use different or newer type of memory such as HBM, GDDR6X, and GDDR7, which have different defenses. The research team plans to investigate these chips in the future so they don\u2019t discount the possibility that alternative attack patterns could exist for them.<\/p>\n

Why does this matter?<\/h2>\n

In the age of AI models, enterprise and server-class GPUs are valuable because they are needed for both training or fine-tuning AI models and for running them, known as inference. Even without AI, these GPUs are usually installed in datacenters and run sensitive workloads often from multiple virtual machines at the same time.<\/p>\n

In their tests, the researchers managed to crash GPUs so often that within one day the cards flagged themselves as defective and due for replacement using their internal crash detection mechanisms. Aside from triggering denial-of-service conditions that kill all the workloads running on the card, the researchers managed to corrupt the GPU\u2019s memory page tables in a way that allowed an unprivileged program to escalate its privileges to root.<\/p>\n

\u201cWhen a GPU is time-shared between users (common in cloud AI services), an attacker running on the same card can flip bits in a victim\u2019s data and crash the shared GPU,\u201d the researchers said. \u201cEven if the GPU is not time shared, any untrusted code that runs on the GPUs (e.g., ML models requiring packages downloaded from the internet that may have been compromised) can escalate to root-level privileges, and serve as an entry-point for malware into the system.\u201d<\/p>\n

Mitigation<\/h2>\n

Because this attack exploits a design flaw, a complete fix requires better hardware defenses built into future generations of GPUs, but until then users should be careful about running untrusted code in their GPUs and should monitor Nvidia\u2019s error-correction counters, because a spike in these counters could be an indication that an attack is in progress.<\/p>\n

GPUThor was reported to Nvidia in April and the company issued a new security advisory<\/a> about the attack this week. The advisory contains additional recommendations such as enabling host IOMMU\/DMA isolation where supported and using the nvidia-smi tool or supported out-of-band management interfaces to monitor the ECC telemetry of the cards.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Hardware security researchers from University of Toronto have developed a new memory bit flipping technique that significantly improves on previously known attacks against GPU memory. The new method can defeat the error-correcting codes (ECC) defense used on enterprise Nvidia GPUs and can lead to root access on the underlying system. Dubbed GPUThor, the technique falls […]<\/p>\n","protected":false},"author":0,"featured_media":9252,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9251","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9251"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9251"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9251\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9252"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}