1. 5

Abstract: “Graphics processing units (GPUs) are important components of modern computing devices for not only graphics rendering, but also effcient parallel computations. However, their security problems are ignored despite their importance and popularity. In this paper, we frst perform an in-depth security analysis on GPUs to detect security vulnerabilities. We observe that contemporary, widely-used GPUs, both NVIDIA’s and AMD’s, do not initialize newly allocated GPU memory pages which may contain sensitive user data. By exploiting such vulnerabilities, we propose attack methods for revealing a victim program’s data kept in GPU memory both during its execution and right after its termination. We further show the high applicability of the proposed attacks by applying them to the Chromium and Firefox web browsers which use GPUs for accelerating webpage rendering. We detect that both browsers leave rendered webpage textures in GPU memory, so that we can infer which webpages a victim user has visited by analyzing the remaining textures. The accuracy of our advanced inference attack that uses both pixel sequence matching and RGB histogram matching is up to 95.4%.”


  2. 2

    Great paper. Builds off the GPU side channel that many people shrugged off as lacking impact. That said the mitigations section (or lack thereof) is a bit disappointing: “GPUs should clear local memory, but they won’t because it’s too slow” is likely accurate, but the authors don’t go on to discuss any even possibly feasible mitigations. I’m not saying it’s a simple problem, but these authors are certainly best suited to trying to tackle it, or at least hypothesize about it.

    1. 2

      but these authors are certainly best suited to trying to tackle it, or at least hypothesize about it.

      I don’t know. GPU’s are complicated, performance-focused, parallel hardware probably done with full-custom ASIC’s (just guessing there). I’d like to have seen them hypothesize about it. Yet, it will probably take people with experience in high-performance hardware and graphics cards to evaluate how feasible the solution would be. An example might be area of silicon vs speed tradeoffs.

      1. 2

        Fair point. I really like seeing well-rounded systems security papers - perhaps bringing in additional voices could’ve aided the mitigation section, but of course that would take time, and publication pressure is real.

        1. 1

          That’s a good summary of the tradeoff they probably made.