NVIDIA RTX A6000 ECC Security Breached by GPUThor Attack

Researchers from the University of Toronto have demonstrated a security flaw that compromises the integrity of NVIDIA's professional workstation GPUs. This finding matters because it undermines the hardware-level error correction that enterprise users rely on for data safety in cloud and high-performance computing environments. The attack, named GPUThor, proves that these cards are not immune to memory manipulation techniques previously thought to be blocked by their internal safeguards.

University of Toronto researchers demonstrate how triple-bit flips bypass error correction

The vulnerability targets the Ampere architecture used in NVIDIA's RTX A-series workstation cards, specifically impacting models like the RTX A6000, RTX A5000, RTX A4500, and RTX A4000. These GPUs feature 48GB, 24GB, 20GB, and 16GB of GDDR6 memory respectively, and they all share the same underlying security mechanism. The flaw allows an attacker to bypass the standard error correction codes designed to protect against bit flips in the video memory.

• Memory Capacity: 48GB GDDR6
• ECC Support: SECDED
• Architecture: Ampere

GPUThor operates by inducing triple-bit flips in the GDDR6 memory, which exceeds the correction capability of the SECDED error correction code found in these cards. SECDED can only fix single-bit errors, leaving triple-bit errors uncorrected and readable by the attacker. The attack exploits a approximately 10-millisecond delay in the GPU's handling of these uncorrectable errors, giving the malicious process enough time to read tampered data before the system terminates the process.

This vulnerability enables privilege escalation, allowing a normal user on a multi-tenant GPU cloud service to gain root access to the host system. NVIDIA has acknowledged the risk in a recent security advisory but has not provided a software patch or detailed mitigation strategy beyond enabling ECC. The company states that while ECC raises the barrier for attackers, it is no longer an absolute defense against this specific type of hardware-level breach.

We looked at RTX Spark mini PC earlier while tracking NVIDIA launches and similar professional hardware trends. The confirmed facts show that the RTX A6000 and related Ampere workstation cards are susceptible to this specific memory attack vector. Users relying on these cards for sensitive enterprise workloads should be aware that hardware ECC alone does not guarantee protection against GPUThor.