News for hackers. Stuff that matters.

A comment on New pixel-stealing attack works against GPUs from all 6 major suppliers. Parent comment

Re:New pixel-stealing attack works against GPUs from all 6 m... by chatmasta on Tuesday September 26, 2023 @08:06PM (#37667743)
Technically it's the use of the GPU for rendering the SVG that's the issue. Perhaps even without GPU rendering there'd be similar side channels available, but at least they'd be "software visible" (to use the words of the paper) rather than "software transparent."

Something I didn't understand from my skimming of the paper, though: does this side channel only apply to windows/iframes within the same browser? Why couldn't it apply to windows of different apps? If the GPU rendered a frame buffer somewhere on the screen, then is that exposed by the attack, regardless of whether it's within the browser? e.g. could Chrome.app identify some pixels from a PDF open in Preview.app?

[ Parent | on HN ]
Re:New pixel-stealing attack works against GPUs from all 6 m... by kevingadd on Tuesday September 26, 2023 @09:36PM (#37668634)
Normally pixels belonging to other processes aren't visible to you. There have been incidents in the past where (usually due to a driver bug) processes could grab pixels from other processes' textures/render targets, but normally you're only supposed to be able to get those pixels by asking the OS (usually its compositor specifically) for them.

I think this side channel partly relies on being able to stack the iframe on top of attacker-controlled image content. Preview.app will be at an unknown position on the screen, and the Chrome.app window could also be at any position and move, so it's much harder to imagine a way to apply this attack in that scenario.

[ Parent | on HN ]