Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA): GPUs apply data-dependent lossless

UnscoredNCVD-2023-003-integrated-gpu-graphics-data-comNVIDIA / GPU stackGPU.zipgraphics data compression side channelcurated

Impact

GPUs apply data-dependent lossless compression to framebuffer traffic even when software never asked for it, and the resulting DRAM traffic pattern is measurable from a co-resident context. The published attack recovered pixel data cross-origin from a browser. For a datacenter operator the realistic worry is remote-desktop, cloud-gaming and VDI fleets where the rendered surface is a customer's screen. No CVE was assigned and the affected vendors declined to ship fixes.

Who can reach it

A co-resident attacker able to render and time - in the original work, a web page in another browser tab. On a shared render host, another tenant's session.

What to do

UNPATCHABLE. Vendors treated the compression as working-as-designed and the browsers mitigated the specific web attack by restricting cross-origin iframe rendering. There is no GPU driver or firmware update. If you sell shared remote-desktop or cloud-gaming capacity, the only real control is not co-residing untrusted sessions on the same GPU.

References

https://www.hertzbleed.com/gpu.zip/https://arxiv.org/abs/2310.01187

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.