News for hackers. Stuff that matters.

A comment on Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM. Parent comment

Re:Is Your VirtualBox Reading Your E-Mail? Reconstruction of... by brtmr on Sunday March 22, 2015 @06:28AM (#9246274)
The webgl standard has rather strong memory safety considerations:

WebGL resources such as textures and vertex buffer objects (VBOs) must always contain initialized data, even if they were created without initial user data values.[0]

As long as browser vendors implement this (and chrome and firefox seem to), this should not be an issue.

[0] https://www.khronos.org/registry/webgl/specs/1.0.3/

[ Parent | on HN ]
Re:Is Your VirtualBox Reading Your E-Mail? Reconstruction of... by exDM69 on Sunday March 22, 2015 @07:23AM (#9246379)
This was a problem with WebGL a few years ago on some OS/GPU/Browser combinations. It was possible to write a WebGL app that created uninitialized textures, drew them on screen, grabbed a screenshot and then uploaded that via HTTP(s) to a server.

This issue should now be fixed, but bugs and/or old unpatched browsers may still be out there.

[ Parent | on HN ]
Re:Is Your VirtualBox Reading Your E-Mail? Reconstruction of... by greggman on Sunday March 22, 2015 @11:36AM (#9247089)
That browsers have bugs that might leak info is not special to WebGL or GPUs. The bugs are found, they get fixed.
[ Parent | on HN ]
Re:Is Your VirtualBox Reading Your E-Mail? Reconstruction of... by exDM69 on Monday March 23, 2015 @04:47AM (#9249956)
Oh sure, but in this particular case it seemed like no-one had thought about the issue that uninitialized textures can be used for snooping screen content, this wasn't mandated by the spec (IIRC).
[ Parent | on HN ]