A newly disclosed Rowhammer technique called GPUThor can bypass error-correcting code protections on NVIDIA GPUs, according to BleepingComputer, which cites a University of Toronto research paper. The report says the attack can trigger denial-of-service conditions and, in a more severe scenario, support root-level privilege escalation on affected systems. The attack was demonstrated against NVIDIA Ampere-class workstation GPUs using GDDR6 memory, specifically the RTX A4000, RTX A4500, RTX A5000, and RTX A6000, BleepingComputer reports. The outlet notes that these cards are used in AI and cloud infrastructure, making the research relevant beyond desktop security. Rowhammer attacks work by repeatedly accessing, or “hammering,” memory rows until electrical disturbance causes bits in nearby rows to flip. Those flips can corrupt data or alter security-critical structures. In GPU environments, BleepingComputer notes the risk extends to AI workloads because model training depends heavily on GPU memory integrity. NVIDIA uses protections including single-error correction, double-error detection error-correcting code, known as SECDED ECC, to correct single-bit faults and detect double-bit faults inside monitored memory blocks. GPUThor’s core finding, as reported, is that those protections do not fully close off GPU Rowhammer exploitation on the tested hardware. According to BleepingComputer, the University of Toronto team made GPUThor more practical by using a non-uniform hammering pattern designed to avoid triggering GDDR6 Target Row Refresh mitigations. The researchers reportedly accounted for two undocumented GPU behaviors: how repeated memory requests are coalesced and how often Target Row Refresh activates. The reported rates are materially higher than the researchers’ earlier GPUHammer work. With ECC protections disabled, GPUThor generated 72,000 to 377,000 flips per GB on the tested GPUs, BleepingComputer says. That is described as 4,548 to 23,597 times higher than GPUHammer and close to the bit-flip rates seen in strong central processing unit Rowhammer attacks such as Blacksmith. At those rates, the researchers said finding an exploitable bit flip could take roughly 1.1 minutes, compared with 21.9 hours for GPUHammer. With ECC enabled, the reported results were not cleanly contained. BleepingComputer says the researchers observed 387 double-bit errors that ECC detected but could not correct, along with two triple-bit errors that ECC repaired incorrectly, causing data corruption. That matters because ECC is meant to convert many raw memory faults into corrected or at least detected events; the paper’s reported result suggests some multi-bit patterns can still produce dangerous behavior. The denial-of-service demonstration was run on an ECC-enabled RTX A6000, according to the report. GPUThor caused the card to reset roughly every two hours, terminating workloads. BleepingComputer also says that, after repeated attacks on the same card, the device would eventually mark itself as requiring replacement. The more severe claim is privilege escalation. BleepingComputer reports that the researchers say GPUThor can corrupt GPU page tables, allowing an unprivileged CUDA program to gain arbitrary memory access and open a root shell on the host system. Beyond the four confirmed workstation models, the report says the researchers believe privilege escalation may still work on server-class Ampere GPUs such as the A100 because they also rely on SECDED-level ECC, though the report separately notes limitations that improve resilience to denial-of-service conditions. Who benefits: Security teams running the listed NVIDIA Ampere workstation GPUs benefit from a concrete set of models and failure modes to assess. Rowhammer researchers also get a reported technique for producing far higher GPU bit-flip rates than prior GPUHammer work. Who's exposed: The clearest exposure is for systems using RTX A4000, RTX A4500, RTX A5000, and RTX A6000 GPUs with GDDR6 memory, based on the models BleepingComputer says were demonstrated. The report also says privilege escalation may still be possible on server-class Ampere A100 GPUs, though that claim is presented as the researchers’ assessment rather than a listed confirmed demonstration in the summary provided.