Loading today’s stories
Security1 distinct publisher3 min readPublished
University of Toronto researchers cut the hunt for an exploitable bit flip from 21.9 hours to about 1.1 minutes, and logged two errors that ECC repaired incorrectly.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
SECDED does one job well and one job badly. It corrects a single flipped bit in a monitored word and detects two [4]. Three bits in the same word sits outside its design, and the University of Toronto team reached that state: two triple-bit errors that ECC repaired incorrectly, producing corrupted data [9]. The other 387 multi-bit events with ECC enabled were detected but not correctable [8]. So of the 389 multi-bit events logged, roughly 0.5 percent came back wrong and marked clean [2].
That split is the whole argument about model integrity. The 387 are loud; they are what drives the observed denial of service, where an ECC-enabled RTX A6000 resets every two hours and kills every workload on it [10], and eventually flags itself as needing replacement [11]. Twelve resets a day is an availability incident somebody will notice [3]. The two are the ones that matter for a training run or an inference weight, because nothing upstream is told anything went wrong.
The rate work is what makes any of this operational rather than academic. By accounting for how the GPU coalesces repeated memory requests and how often GDDR6 fires Target Row Refresh, both undocumented behaviours, the researchers hammered in a non-uniform pattern below the TRR trigger and produced 6.6 times more aggressor-row activations than their earlier work [5][6]. Without ECC that yielded 72,000 to 377,000 flips per GB on the tested cards [7]. At those rates, an exploitable flip turns up in about 1.1 minutes instead of 21.9 hours [12], a speedup of roughly 1,195 times [1]. Twenty-two hours of hammering is a lab artifact. Sixty-six seconds fits inside a rented session.
The escalation path is page tables. The researchers claim corruption of GPU page tables gives an unprivileged CUDA program arbitrary memory access and a root shell on the host [13]. The demonstrated cards are workstation parts, RTX A4000 through A6000 on GDDR6 [3], but the researchers say privilege escalation should still work on server-class A100 because it relies on the same SECDED-level ECC [14], and that RAS Repair on some Blackwell parts makes the attack slower without preventing it [15].
NVIDIA's advisory, published on 21 August after an April 29 report [16], recommends SYS-ECC plus IOMMU/DMA isolation, error telemetry monitoring, and restricting untrusted workloads [17]. The company also says risk varies by DRAM device and platform, and that no flips were observed on the GDDR6X or HBM2e GPUs it tested with the same patterns [18]. That is not a rebuttal of the GDDR6 result; it is a narrower claim about other memory. The researchers, for their part, say complete protection likely needs multi-bit ECC in future hardware, and until then advise against cross-tenant GPU sharing [19].
Both parties land on watching ECC error counters [17][19]. The counters saw 387 of 389 [2].
Ranked by verification strength, evidence, and original report placement.
A newly disclosed Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial of service and root-level privilege escalation.
The researchers claim privilege escalation to root is possible by corrupting GPU page tables, giving an unprivileged CUDA program arbitrary memory access and opening a root shell on the host system.
On some Blackwell GPUs the RAS Repair resilience feature makes a GPUThor attack more time consuming but does not prevent it, and the researchers say even HBM3/e and GDDR7 GPUs with on-die ECC might be vulnerable if multi-bit flips are triggered.
GPUThor is described in a paper published by the University of Toronto, and the researchers say it achieves far more practical bit-flip rates than their earlier GPUHammer and GPUBreach concepts, which became irrelevant after ECC was introduced.
The attack was demonstrated against Ampere-class NVIDIA workstation GPUs with GDDR6 memory, including the RTX A4000, RTX A4500, RTX A5000 and RTX A6000, all widely used in AI and cloud infrastructure.
NVIDIA uses mitigations such as SECDED ECC, which corrects single-bit errors and detects double-bit errors within monitored memory blocks.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Quantified single-source research report, no independent reproduction
The cluster carries specific, testable measurements (72,000-377,000 flips per GB, 387 detected uncorrectable double-bit errors, two silent miscorrections, 6.6x aggressor activations, 1.1 minutes versus 21.9 hours) attributed to a named University of Toronto paper, plus a vendor advisory that partially corroborates the issue's existence. It rests on one publisher relaying one paper, with no independent replication, no advisory identifier and no third-party confirmation of the root shell chain.
Vendor advisory issued; no field exploitation or mitigation uptake data
Observable ecosystem response is limited to coordinated disclosure and an NVIDIA advisory with configuration guidance against widely deployed Ampere hardware. There is no evidence of exploitation in the wild, no cloud or hosting provider response, no firmware or driver fix, and no data on whether operators have enabled the recommended SYS-ECC and IOMMU/DMA isolation settings.
Slightly overstated generalization on a well-measured narrow result
The measured results on Ampere GDDR6 workstation cards are strong and specific, so the core finding is not inflated. The overstatement is in reach: the ECC-bypass and root framing is presented broadly while the demonstrated platform set is four workstation GPUs, the A100, Blackwell, HBM3/e and GDDR7 exposure is asserted rather than demonstrated, and NVIDIA reports no flips on tested GDDR6X or HBM2e parts using the same patterns.
Researcher self-benchmarking, vendor scope-limiting, and sponsored content in the same item
Every framing party has a visible stake: the researchers benchmark GPUThor against their own prior GPUHammer and GPUBreach work, which rewards large improvement multipliers; NVIDIA's advisory emphasizes configuration variance and untested-platform negatives that narrow its exposure; and the publisher closes the article with promotion of a sponsored third-party security report. None of these are disqualifying, but they shape emphasis on both the alarm and the reassurance side.
Moderate: precise numbers, one publisher, unverified worst case
Confidence is held down by single-publisher, single-paper sourcing and by the fact that the highest-impact claim (root shell on the host) is unreproduced, while it is supported upward by coordinated disclosure, a corroborating vendor advisory, and unusually specific quantitative results that would be straightforward to contradict if wrong.
product
The $500bn compute asset class rests on a depreciation curve Nvidia once denied1 distinct publisher
build
China's accelerator swap makes Cambricon supply, not export policy, your ship-date risk1 distinct publisher
build
Nvidia's Groq-derived LPX rack posts 3,431 tokens/sec on 128GB of SRAM1 distinct publisher
invest
Beijing can ban Nvidia purchases faster than it can replace CUDA1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 26, 2026