Researchers Uncover New GPU Aspect-Channel Vulnerability Leaking Delicate Information – Supply:thehackernews.com

A novel side-channel assault referred to as GPU.zip renders just about all trendy graphics processing items (GPU) susceptible to info leakage.

“This channel exploits an optimization that is data dependent, software transparent, and present in nearly all modern GPUs: graphical data compression,” a gaggle of teachers from the College of Texas at Austin, Carnegie Mellon College, College of Washington, and the College of Illinois Urbana-Champaign said.

Graphical data compression is a characteristic in built-in GPUs (iGPUs) that enables for saving reminiscence bandwidth and bettering efficiency when rendering frames, compressing visible information losslessly even when it’s not requested by software program.

The research discovered that the compression, which occurs in varied vendor-specific and undocumented methods, induces data-dependent DRAM site visitors and cache occupancy that may be measured utilizing a side-channel.

“An attacker can exploit the iGPU-based compression channel to perform cross-origin pixel stealing attacks in the browser using SVG filters, even though SVG filters are implemented as constant time,” the researchers stated.

“The reason is that the attacker can create highly redundant or highly non-redundant patterns depending on a single secret pixel in the browser. As these patterns are processed by the iGPU, their varying degrees of redundancy cause the lossless compression output to depend on the secret pixel.”

Profitable exploitation might enable a malicious internet web page to deduce the values of particular person pixels from one other internet web page embedded in an iframe ingredient within the newest model of Google Chrome, successfully circumventing important safety boundaries akin to same-origin coverage (SOP).

Chrome and Microsoft Edge are significantly susceptible to the assault as a result of they permit cross-origin iframes to be loaded with cookies, allow rendering SVG filters on iframes, and delegate rendering duties to the GPU. Nonetheless, Mozilla Firefox and Apple Safari aren’t impacted.

In different phrases, the GPU graphical information compression leakage channel can be utilized to steal pixels from a cross-origin iframe by “either measuring the rendering time difference due to memory bus contention or by using the LLC walk time metric to infer the GPU-induced CPU cache state changes.”

A proof-of-concept (PoC) devised by the researchers found that it’s potential for a risk actor might trick a possible goal into visiting a rogue web site and be taught details about a logged-in consumer’s Wikipedia username.

This, in flip, is rooted in the truth that some internet requirements enable for the framing web page to use visible results (i.e., SVG filters) to the iframed web page, thereby exposing the mechanism to side-channel assaults by, say, computing the time variations between rendering black and white pixels after which distinguish between them utilizing the timing info.

Affected GPUs embody these from AMD, Apple, Arm, Intel, Nvidia, and Qualcomm. That stated, web sites that already deny being embedded by cross-origin web sites by way of X-Frame-Options and Content material Safety Coverage (CSP) guidelines aren’t inclined to the pixel-stealing assault.

The findings come on the again of a associated side-channel assault referred to as Hot Pixels that leverages the same strategy to conduct “browser-based pixel stealing and history sniffing attacks” in opposition to Chrome and Safari internet browsers.

Discovered this text fascinating? Comply with us on Twitter  and LinkedIn to learn extra unique content material we put up.