Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA): MULTI-TENANT ISOLATION: GPUs apply

Impact

MULTI-TENANT ISOLATION: GPUs apply data-dependent lossless compression to framebuffer traffic even when software never asked for it, and the resulting DRAM traffic pattern is measurable from a co-resident context. The published attack recovered pixel data cross-origin from a browser. For a datacenter operator the realistic worry is remote-desktop, cloud-gaming and VDI fleets where the rendered surface is a customer's screen. No CVE was assigned and the affected vendors declined to ship fixes.

Who can reach it

A co-resident attacker able to render and time - in the original work, a web page in another browser tab. On a shared render host, another tenant's session.

What to do

UNPATCHABLE. Vendors treated the compression as working-as-designed and the browsers mitigated the specific web attack by restricting cross-origin iframe rendering. There is no GPU driver or firmware update. If you sell shared remote-desktop or cloud-gaming capacity, the only real control is not co-residing untrusted sessions on the same GPU.

References