GPUThor Non-Uniform Rowhammer Achieves 377k Bit Flips per GB on RTX A5000 GDDR6, Defeating TRR and SECDED ECC

The attack requires an unprivileged CUDA kernel on shared or single-tenant Ampere GPUs. Non-uniform warp scheduling concentrates activations on aggressor rows while distributing decoy accesses across separate warps, overwhelming the memory controller's merged activation path. This produced 72,000 to 377,000 flips per gigabyte across four tested cards with ECC off, compared to GPUHammer's 16 flips per gigabyte.

Evidence shows TRR activates only once every 72 refresh intervals on these GDDR6 parts. Researchers built a six-interval pattern around that schedule, yielding 387 double-bit and two triple-bit flips at 16-byte granularity. With ECC enabled on an A6000, one bank generated 11 DUEs and one silent data corruption over 24 hours, aborting all kernels every two hours on average.

NVIDIA's July 2025 notice claims System-Level ECC neutralizes the prior GPUHammer attack, yet the new data demonstrates that non-uniform patterns still induce detectable uncorrectable errors and mis-corrections. This pattern matches Blacksmith's DDR4 findings and indicates procurement contracts for shared GPU workloads in finance and defense lack adequate isolation requirements.

Next steps include vendor firmware updates to TRR frequency and contract clauses mandating dedicated GPU tenancy for sensitive workloads. Without these changes, cross-tenant environments face escalating risk of privilege escalation within 12 months.