Researchers Uncover a New GPU Side-Channel Vulnerability Leaking Sensitive Data

A novel side-channel attack known as GPU.zip renders practically all modern-day graphics processing units (GPU) vulnerable to data leakage.

“This channel exploits an optimization that is knowledge dependent, program transparent, and current in approximately all fashionable GPUs: graphical information compression,” a group of lecturers from the University of Texas at Austin, Carnegie Mellon University, College of Washington, and the University of Illinois Urbana-Champaign claimed.

Graphical knowledge compression is a element in built-in GPUs (iGPUs) that makes it possible for for saving memory bandwidth and improving effectiveness when rendering frames, compressing visual information losslessly even when it really is not asked for by software package.

The research observed that the compression, which takes place in many seller-precise and undocumented means, induces information-dependent DRAM targeted visitors and cache occupancy that can be measured using a aspect-channel.

“An attacker can exploit the iGPU-based mostly compression channel to carry out cross-origin pixel stealing attacks in the browser applying SVG filters, even while SVG filters are executed as continuous time,” the scientists mentioned.

“The reason is that the attacker can create hugely redundant or extremely non-redundant patterns dependent on a one top secret pixel in the browser. As these patterns are processed by the iGPU, their various levels of redundancy cause the lossless compression output to count on the secret pixel.”

Prosperous exploitation could let a malicious web web page to infer the values of personal pixels from a further web website page embedded in an iframe element in the latest model of Google Chrome, properly circumventing critical security boundaries such as exact-origin policy (SOP).

Chrome and Microsoft Edge are specially susceptible to the attack mainly because they make it possible for cross-origin iframes to be loaded with cookies, allow rendering SVG filters on iframes, and delegate rendering jobs to the GPU. Nevertheless, Mozilla Firefox and Apple Safari are not impacted.

In other words and phrases, the GPU graphical facts compression leakage channel can be utilized to steal pixels from a cross-origin iframe by “either measuring the rendering time difference owing to memory bus rivalry or by employing the LLC walk time metric to infer the GPU-induced CPU cache condition changes.”

A proof-of-strategy (PoC) devised by the researchers identified that it is really feasible for a menace actor could trick a potential focus on into viewing a rogue web site and find out data about a logged-in user’s Wikipedia username.

Upcoming WEBINARFight AI with AI — Battling Cyber Threats with Up coming-Gen AI Resources

All set to tackle new AI-driven cybersecurity difficulties? Join our insightful webinar with Zscaler to address the increasing menace of generative AI in cybersecurity.

Supercharge Your Competencies

This, in turn, is rooted in the truth that some web expectations let for the framing web page to use visible results (i.e., SVG filters) to the iframed web site, thereby exposing the system to facet-channel attacks by, say, computing the time differences between rendering black and white pixels and then distinguish between them utilizing the timing information.

Impacted GPUs involve people from AMD, Apple, Arm, Intel, Nvidia, and Qualcomm. That mentioned, web-sites that presently deny remaining embedded by cross-origin web sites by using X-Body-Options and Written content Security Plan (CSP) principles are not susceptible to the pixel-thieving attack.

The conclusions come on the back again of a relevant side-channel attack called Warm Pixels that leverages a related method to conduct “browser-based pixel thieving and historical past sniffing attacks” in opposition to Chrome and Safari web browsers.

Observed this write-up appealing? Abide by us on Twitter  and LinkedIn to read through a lot more exceptional information we put up.

Some sections of this article are sourced from:
thehackernews.com