GPUs from all major suppliers are vulnerable to new pixel

The security threats that can result when HTML is embedded in iframes on malicious websites have been well-known for more than a decade. Most websites restrict the cross-origin embedding of pages displaying user names, passwords, or other sensitive content through X-Frame-Options or Content-Security-Policy headers. Not all, however, do. One example is Wikipedia, which shows the usernames of people who log in to their accounts. A person who wants to remain anonymous while visiting a site they don’t trust could be outed if it contained an iframe containing a link to https://en.wikipedia.org/wiki/Main_Page.

The researchers showed how GPU.zip allows a malicious website they created for their PoC to steal pixels one by one for a user’s Wikipedia username. The attack works on GPUs provided by Apple, Intel, AMD, Qualcomm, Arm, and Nvidia. On AMD’s Ryzen 7 4800U, GPU.zip took about 30 minutes to render the targeted pixels with 97 percent accuracy. The attack required 215 minutes to reconstruct the pixels when displayed on a system running an Intel i7-8700.

All of the GPUs analyzed use proprietary forms of compression to optimize the bandwidth available in the memory data bus of the PC, phone, or other device displaying the targeted content. The compression schemes differ from manufacturer to manufacturer and are undocumented, so the researchers reverse-engineered each one. The insights yielded a method that uses the SVG, or the scalable vector graphics image format, to maximize differences in DRAM traffic between black and white target pixels in the presence of compression. While their paper discusses GPU.zip as it applies to iGPUs, or internal GPUs, the technique applies equally to standalone or discrete GPUs as well.

In their paper, the researchers wrote:

We demonstrate that an attacker can exploit the iGPU-based compression channel to perform cross-origin pixel stealing attacks in the browser using SVG filters (the latest version of Google Chrome as of April 2023), even though SVG filters are implemented at constant time. The reason is that the attacker can create highly redundant or highly non-redundant patterns depending on a single secret pixel in the browser. As these patterns are processed by the iGPU, their varying degrees of redundancy cause the lossless compression output to depend on the secret pixel. The data-dependent compression output directly translates to data-dependent DRAM traffic and data-dependent cache occupancy. Consequently, we show that, even under the most passive threat model—where an attacker can only observe coarse-grained redundancy information of a pattern using a coarse-grained timer in the browser and lacks the ability to adaptively select input—individual pixels can be leaked. Our proof-of-concept attack succeeds on a range of devices (including computers, phones) from a variety of hardware vendors with distinct GPU architectures (Intel, AMD, Apple, Nvidia). Surprisingly, our attack also succeeds on discrete GPUs, and we have preliminary results indicating the presence of software-transparent compression on those architectures as well.

A threat now? Probably not. But…

Data compression is a common feature for increasing the performance of software and hardware. It uses complex math to represent redundancies in a file or chunk of data and reduce the number of bits it has. Compression has also been a common side channel that forms the cornerstone of several attacks over the past decade. Examples include: the CRIME, or Compression Ratio Info-leak Made Easy, exploit for decrypting some HTTPS traffic; another attack on HTTPS encryption known as BREACH, short for Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext; an attack known as VORACLE from 2018; and, in 2021, the Practical Timing Side-Channel Attacks on Memory Compression.