Nvidia GPUs Can Leak Data From Google Chrome's Incognito Mode (softpedia.com) 148
An anonymous reader writes: Nvidia GPUs don't clear out memory that was previously allocated, and neither does Chrome before releasing memory back to the shared memory pool. When a user recently fired up Diablo 3 several hours after closing an Incognito Mode window that contained pornography, the game launched with snapshots of the last "private" browsing session appearing on the screen — revealing his prior activities. He says, "It's a fairly easy bug to fix. A patch to the GPU drivers could ensure that buffers are always erased before giving them to the application. It's what an operating system does with the CPU RAM, and it makes sense to use the same rules with a GPU. Additionally, Google Chrome could erase their GPU resources before quitting."
Porn AND Diablo? (Score:5, Funny)
Are you sure this isn't God judging your evil deeds?
/duck
/run
Re: (Score:2)
Are you sure this isn't God judging your evil deeds? /duck /run
Probably searching for Enchantress porn as well.
Re: (Score:2)
That depends - does it rely on him putting on his Wizard Hat and Robe?
Re: (Score:2)
I think it's more likely that Diablo was extremely horny [imgur.com].
Re: (Score:1)
Certainly, only God felt that the guy did not view the porn for long enough and gave him a little extra glimpse before he got his game on.
Ads (Score:5, Interesting)
> Google Chrome could erase their GPU resources before quitting.
Why blank it when you can write a gaming ad to the buffer instead? #incentives
Why write a gaming ad when you can write a Radeon ad instead? #alsoincentives
Re: (Score:2)
Re: (Score:2)
Patents cost money to file, and require a lot of effort to write. It's still a good idea, just an expensive one.
Re: (Score:1)
There is also the bug where Diablo 3 is displaying effectively random data [data it allocated in the GPU, but never initialized before displaying].
Note (Score:1)
Google have said they won't fix the bug.
Re: (Score:1)
Google have said they won't fix the bug.
In other shocking news, researchers have discovered that when an application releases storage resources, instead of writing a series of random data patterns onto the disk, the OS simply marks the space as "free". Even though this would be a simple fix, Google has chosen not to do it!
Re: Note (Score:2)
Oh, is Chrome caching incognito mode data on disk and failing to shred it? Crappy spyware.
Re: (Score:2)
Oh, is Chrome caching incognito mode data on disk and failing to shred it? Crappy spyware.
Thats not what this article says.
Re: (Score:3)
There's some BIG differences there. First, there's OS tools available that try to handle this case. Second, there's great workarounds for this insecure-but-fast disk habit, such as storing the data encrypted, or on an encrypted partitions. Third, the time/tradeoff is much greater with disk cases- writing a block of RAM on SHUTDOWN ONLY is not nearly as great a burden as writing over an arbitrary file on the disk.
I could see Google's position on this- it's not technically their fault- but they could at le
Re: (Score:2)
Additionally, if you're using a Copy-On-Write file system like ZFS, the contents wouldn't be overwritten anyways.
Re: (Score:2)
You mean blank on de-allocation. Unless you are going to try and track every block you've ever used (and possibly released -- and possibly now owned by someone else) and do it at exit -- which smells like a memory leak waiting to happen. Otherwise you need to blank before de-allocating it, which depending on how much is being allocated/de-allocated could significantly impact performance.
Re: (Score:1)
Do you mind a dumb question?
If the user has enough RAM, wouldn't it be possible to reserve a goodly chunk and then wipe the entirety (some resource hit here - I should think) when de-allocated/closed such as at the end of the session?
I'm slowly, but surely, getting back into poking at code - it's been like 8 years since I've even really looked at any and even longer since I've really done much of any. I'm seeing why this is happening (I think) but I'm not seeing why it's not being fixed. At least conceptual
Re: (Score:3)
Why should Google fix Nvidia's fuck up? Like they even could.
There's plenty to not like about some of Google's recent moves, but you're just being a hater here.
Re: (Score:1)
shouldn't an application that purports to be "secure" be paranoid enough to zero-out any memory it used "just in case". sure, the driver/OS *should* do this, but the application arguably shouldn't trust that they will. IMHO
Re: (Score:1)
Re: (Score:2)
Technically, it's a feature.
In ye olden days, writing zeroes to a chunk of memory when it was freed could actually take a long time and bog down the single processing thread that existed in your CPU. To avoid that, the memory was simply marked as unused without clearing it. This was a significant performance enhancement at the time.
We're long past the days when we need that particular performance enhancement, but it's still there because "that's the way it's always been done." It's not that it can't be f
Re: (Score:1)
Every modern OS from Windows to Linux clears memory before making it available to user-land. Where the hell have you been for the past 20 years?
Re: (Score:2)
By memory, I'm going to go with the assumption you mean RAM, and specifically RAM attached to the CPU, instead of the more generic term memory which would include any type of memory or RAM attached to other things than the CPU (HDD, SSD, video, cache, processory cache, IO buffers, etc). As this isn't RAM attached to the CPU, it's not exactly the same thing, and modern OSes don't typically blank them before handing them off, sometimes quite thankfully. It would be a major pain if every time an application
They should just rename it PornMode (Score:1)
cmon no one uses it for anything else.
Re:They should just rename it PornMode (Score:5, Insightful)
There is value in using that mode for porn (although your IP address is still exposed, and it's unclear that anyone is going to understand why you were at LustyHotBabes.com for any non auto-erotic pursuits). But it is also incredibly useful for the times you want to visit a site that caches credentials locally or otherwise relies on client-side tracking, but you don't want that behavior. I do not like to leave data for gmail, facebook, linked-in etc. on my work machine, for example, I don't own it and IT can seize it at any time.
Re:They should just rename it PornMode (Score:5, Funny)
it's unclear that anyone is going to understand why you were at LustyHotBabes.com for any non auto-erotic pursuits
I'm sure they read it for the articles. You know, unlike Slashdot where nobody reads the articles.
Re: (Score:2)
Yes, there's value in using incognito mode for porn.
There's value in using a completely separate web browser for, say, online banking. I'd only trust incognito mode to be "good enough".
Not just PornMode (Score:5, Interesting)
I use "incognito mode" all the time. Anytime I see some interesting link on Facebook, I always open it in incognito mode. Just one more level of protection against associating the link with my account or leaving behind unwanted trash.
I also find it very useful for news sites that let you have a certain number of articles free before throwing up a paywall. Using incognito mode resets the counter back to zero.
Re: Not just PornMode (Score:1)
Incognito mode is actually more of a developer tool. If you want to make sure you see the site you are developing "fresh" without having to worry about pre-existing cookies or local storage values.
Re: (Score:2)
Re: (Score:2)
I use private/incognito mode to access my bank, so that I can be sure there are no XSS attacks. It's also useful for browsing pages you are working on so that you know nothing is cached. Plus you can have two simultaneous sessions going with the same browser, but cookies and history won't be shared. It is also good for testing supercookies.
I kinda like the idea of every tab being a "private mode" tab. It's kinda how the web was intended to be in the first place.
Re: (Score:3, Informative)
Use it to browse sites that need cookies to work, but then use them to fix or mess with prices against you. Like airline sites and travel search engines that will sometimes raise prices if you search from a browser with the same cookies.
Use it to follow links you don't want messing with other tracked histories. You see an article on weird stuff for sale but don't want Amazon or other sites suggesting related stuff every time you visit in the future?
Having trouble with sites that stupidly use cookies to tr
Re: (Score:1)
Re: (Score:2)
AMD Open Source Driver on Linux (Score:5, Informative)
The AMD Open Source Driver on Linux do the same thing. It's not really a new or spectacular bug, graphics cards and drivers have done that stuff for quite a long while. Once there was also a fun bug that would make large texts in Firefox 'bleed' into the desktop background image, so it wasn't just showing old content, but actively manipulating content of another application.
Re: (Score:2)
Easily among the most powerful devices in the system that isn't the CPU(and, while not necessarily ideal for things that aren't specific compute workloads, turing complete), plenty of RAM to store payload to be injected in assorted places or da
Re:AMD Open Source Driver on Linux (Score:5, Insightful)
Yeah. Your GPU was not designed with security of the information stored in it in mind. It was designed to play video games and a few other things, and it's not a big deal if a few of your game textures leak, if it means the GPU can be slightly faster at managing its memory. The responsibility should be Chrome's to clear out its GPU memory in incognito mode after it's done using it.
Re: (Score:3, Insightful)
> Chrome's to clear out its GPU memory in incognito mode after it's done using it.
The driver manages the GPU memory and there is no particular reason to assume that if Chrome did that it would actually write to the same RAM location that had the sensitive data and not some other random memory area it was assigned temporarily.
Thus the calls for Chrome to fix it are nonsense. Yes, it might work. But it might break any time with a driver update. This needs to be in the drivers.
The discussion and arguments i
Re: (Score:1)
Heh! Did you once work for me?
Re:AMD Open Source Driver on Linux (Score:4, Insightful)
Re: (Score:2)
So what do you want to make a bet a clever hacker could then write a webgl script to download pics of your bank information? SOme banks report with javascript ads and can see this used to steal information
Re: (Score:2)
Re: (Score:2)
It goes back to the beginning of computing.
I remember well on the Amiga that after a reset you could run several rippers that would pull out the gfx and music (as long as it was not overwritten) from memory of the game/demo you were playing. Later i saw similar programs in DOS for PC that did the same thing.
Does the linux kernel zero-out the bits it unallocates? I don't know and would assume not, it's an expensive operation.
Re: (Score:1)
Re: Performance Hits? (Score:1)
Most programs don't bother zeroing memory after using it for that very reason. Unless the memory has something important in it, usually.
Re: (Score:1)
Re: Performance Hits? (Score:5, Informative)
Re: (Score:1)
Re: (Score:3)
Speaking as a complete layman, I would think that, just as handling memory allocation is usually left to the OS, in an ideal world the OS' memory allocation mechanism would also be responsible for clearing s
Re: (Score:1)
The OS to blame? Don't think so... (Score:5, Insightful)
The GPU memory is not handled by the OS, it runs on a separate piece of hardware, a full computer system if you allow, that does not run an OS by itself.
The NUMA API for using nVidia cards for GPGPU operations is quite simple and straightforward; when requesting memory, it allocates a chunk; when releasing it, it's just marked as "not yours anymore". Due to the massive parallel programming model, there is even some *value* in not clearing it, as for algorithmic iterations sometimes you can save the cost of populating and freeing memory blocks if you know you will get the same pieces of RAM (or if it does not really matter, and each algorithmic pass can work exclusively on a given set of data until a certain point has reached — think i.e. symmetric encryption schemes).
Due to every time more intelligent C compilers (and of course higher level constructs) we have got used to memory being zeroed out on assignation, but no AFAICT no standard mandates that. I would place the burden of cleaning the memory on the *initialization* of the new application. After all, be it pr0n or just random flipped bits, Diablo looks bad by starting with the display of digital noise.
I don't think it should be *too much* of a concern for Chrome cleaning up before closing a tab. Yes, there is a certain thing about it being "incognito mode" that should be honored, and –as a special case– it *should* ensure to clean up its act. But the main fault I'd say is at Diablo.
Re: (Score:1)
there is even some *value* in not clearing it, as for algorithmic iterations sometimes you can save the cost of populating and freeing memory blocks if you know you will get the same pieces of RAM
Jesus Christ! There are people who know how to program on this site. You're going to give someone a heart attack with comments like that!
Also, it's not Chrome's responsibility to clear the memory. That might be a mitigation strategy, but no OS or driver should ever hand uncleared memory to a different application. Ever! What if Chrome crashes before it can clear the memory? We've had the performance discussion before, when some deemed clearing system RAM too costly. The answer is always the same: It costs w
Re: (Score:2)
there is even some *value* in not clearing it, as for algorithmic iterations sometimes you can save the cost of populating and freeing memory blocks if you know you will get the same pieces of RAM
Jesus Christ! There are people who know how to program on this site. You're going to give someone a heart attack with comments like that!
I don't think gwolf was referring to exploiting the undefined behavior of use after free. I think it was more along the lines of object pooling [wikipedia.org].
Re: (Score:3)
Diablo looks bad by ?starting with the display of digital noise.
This brings up an interesting point, I think what we really have here is an exploit in the NVidia drivers rather than a "Super Scary oh noze mine pr0nz gots pwnd" privacy issue. What if next time, instead of stills from your latest crush fetish video, your VRAM was sitting on a call to "glGetTexImage()" and pulls an arbitrary instruction onto your stack? It is basically telling us that read-after-release is possible and DMA can be a lot of fun in the "right" hands. This is a lot more interesting than this r
Re: (Score:3)
"AFAICT no standard mandates that. I would place the burden of cleaning the memory on the *initialization* of the new application."
Common sense mandates that a multi-user system separates users and processes from each other. If I log off from a workstation, the next user should not be able to do screen captures (potentially confidential documents, emails with passwords) using software that exploits this "feature".
Re: (Score:2)
And it happens as you describe — on the main system's memory. However, the GPU is not the main system. It is more akin to a peripherial computer, with lots of intelligence and RAM of its own. Think of it as a printer. Do you really care if your printer blanks its buffers between jobs? No, as long as one job's leftover contents will in no way corrupt any next job's output.
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
I cannot believe you on this. How was this done? Using cudaMemset, clEnqueueFillBuffer or something equivalent? Or your own code (coalesced memory access...)?
Re: (Score:2)
The performance hit for overwriting 4 gigs (or usually less) of RAM on *process or thread shutdown* shouldn't be that onerous... should it? I could be missing something about when it frees it.
Re: (Score:1)
If the memory space is unallocated then the card should zero out any memory space that was recently released whenever the card isn't under heavy load.
Re: (Score:1)
Nope, it's Google selling "porn mode", it should be up to Google to avoid your feeelthy pictures lying around.
Welcome to 2006 (Score:2)
The GPU, unlike the system / main CPU doesn't necessarily have overview of the applications that are using memory
I thought per-process allocation of video memory was one of the big changes from Windows XP and DirectX 9 to Windows Vista and DirectX 10 that required changes to drivers to support the new Windows display driver model (WDDM).
Re: (Score:2)
Are you saying Windows is more secure than Linux? (Score:2)
Are you claiming that graphics drivers under GNU/Linux cannot tell whether the same process allocated two different chunks of video memory? If so, this is a security advantage of Windows over GNU/Linux, and GNU/Linux developers need to get their act together to fix it.
Re: (Score:2)
Re: (Score:1)
I'll thread this here so that hopefully tepples sees it too. Sometimes it's great to hit the threads late - I usually try to not go further forward than page 1 (unless I am all caught up) for that very reason. Oh, I work back to forward from the eldest unread thread.
Neither of which is here or there.
I could put this almost anywhere in this thread and, I think, it'd be perfectly on-topic. This is absolutely the best, most educational, insightful thread I have read on Slashdot in a *very* long time. This, thi
Re: (Score:1)
Now that I think about it and sorry to reply to myself - but, does this still work if you have disabled 'hardware acceleration' or started it from the terminal with the --disable-gpu-composting because if that's enabled then I think the browser just uses the regular RAM and not the GPU's RAM?
I'm quite positive that I'm missing something because it can't be that easy. I'm gonna scroll down the thread again. I keep getting stuck every few posts and ending up reading a few links from Google just to help me mak
Why is Diablo showing this? (Score:2)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Also, why did the GPU driver assign the exact same start address for the frame buffer? If it randomized this somewhat, I would think you would end up with much less of a chance of this happening without taking a performance hit to clear the buffer whenever launching / cleaning up a thread.
Re: (Score:2)
Because you might be streaming content into the texture after its creation e.g. with GLTexSubImage2D (or 3D). You might already be running the render loop a few times over before it's fully filled. Ideally the driver would only ever give you blanked memory so it would be transparent and imperceptible.
Re: (Score:2)
Why does a web browser need GPU for basic (Score:2)
Why does a web browser need GPU for basic web? unless that is a flash or HTML5 driven pron site?
Re: (Score:2)
Using a GPU to render a website allows faster rendering with lower power usage.
Think of all the elements on a page that can be composited with something designed to do it with different levels of transparency.
If you want laptops and mobiles to run faster and last longer on battery power then part of that is using computer resources more efficiently. Lots of stuff right now is wasted and the CPU is busy with memory IO due to poor algorithms.
Re: Why does a web browser need GPU for basic (Score:5, Insightful)
Re: (Score:2)
Re: (Score:3)
Chrome, and similar, interact substantially more than that; but I thought that most of the various desktop transparency/preview/fancy-window-swooshing/etc. stuff was handled by drawing program output to something that the
Re: (Score:1)
(GPU is irrelevant.)
This browser shows things on the screen, so that the user can see it. (It's not the legendary braille or text-to-speech browser that HTML purists are always warning you that some of your website's users using.)
And of course, if you show things on the screen, then they're going to get into video memory. (So that the user can see what the computer is trying to show them.)
And though I said the GPU is irrelevant to the situation, it turns out there is nevertheless an answer to your quest
Re: (Score:2)
Wait, a video porn site that uses Flash?
Can't be...
WebGL has had similiar issues (Score:2, Insightful)
It's been shown that you randomly snag other running applications data by initializing new framebuffers and seeing what happens to be in them.
The problem is that your graphics card simply cant zero out chunks of ram every time an application requests them, not if you want your high performance rendering for your video games. This issue is an old one, and one that's tied to the hardware architecture itself, and can't be fixed as easily as the submitter seems to think.
Re: (Score:2)
Re: (Score:3)
Consider the following policy: If a process requests video memory, and all of this memory previously belonged to the same process, don't clear it. Otherwise, zero it. And while the GPU is idle, zero some of the memory released by processes in the background, especially by processes that have ended. How would such a policy interfere with "high performance rendering for your video games"?
Re: (Score:2)
Cant we have a choice? Security or speed?
The last time I played it computer game, it was DOS based. Or maybe colossal cave? I don't Need a GPU (and would not buy anything from NVidia if I did. Their own support for Linux is terrible, and Nouveau does not even work).
Re: (Score:2)
It's been shown that you randomly snag other running applications data by initializing new framebuffers and seeing what happens to be in them.
The problem is that your graphics card simply cant zero out chunks of ram every time an application requests them, not if you want your high performance rendering for your video games. This issue is an old one, and one that's tied to the hardware architecture itself, and can't be fixed as easily as the submitter seems to think.
Of course it can. If there is hardware support for it, clearing memory is practically free. Remember DRAM works by refreshing itself every single tick, you can opt not to refresh and thus blank it. Even without that, zeroing using a modern GPUs enourmous parallel power is also cheap.
Google chrome is just mucked up (Score:1)
Personally I just think Chrome is becoming more mucked up by the version. I used to think it was the best browser, but I definitely think Google is going down the Firefox path of over playing serious bugs and continuing to update without fixing the important stuff. I mean it might set all the records for compliance and standards.
But crashes happening regularly, Pepper Flash is awful, I get so many page rendering issues and CPU cycle pegs from Chrome helper on both Mac's and Windows its not funny anymore. I
Re: (Score:2)
Boy Scout rulez apply... (Score:2)
Leave the memory better than you found it.
Been doing this stuff for years and it never even occurred to me that this could be an issue. By "cleaning" up the memory usage on shutdown I just made sure I free'd the memory, not clearing it on the way out.
JVM and .NET VM makers take note - You could add this to your GC and shutdown code and give all programs automatic support for this easily.
Re: (Score:3)
JVM and .NET VM makers take note - You could add this to your GC and shutdown code and give all programs automatic support for this easily.
It would be better to put this in the OS cleanup code, clearing the buffers in a background thread before they're returned to the free pool. If the cleanup is left up to the application or framework then the application could exit due to a crash without getting a chance to clear the buffers.
Re: (Score:2)
Agreed.
But if you're writing a secure program it's something to keep in mind. (Something like a cfree or cdelete might be overkill/difficult to implement because of performance issues or sheer complexity but things like clearing video memory or other specific resources might still be a good idea.)
Honestly, after all the secure software initiatives and outcries that came out in the last decade I'm surprised this didn't pop up until now...
iOS does a similar thing (Score:1)
The multi-tab view in iOS has a similar "bug" where if you're viewing something in private mode the jpg preview for that tab remains even if you change pages/open new/close that specific tab. Can't recall the exact steps to reproduce consistently but I've noticed it several times.
Virtual memory? (Score:2)
Question from a layman: Do GPUs have a physical-virtual memory mapping? Ex: Could process A get space on the GPU, then when process B requests memory, the GPU would give process B the physical pages process A used to have (while copying the actual data over) to defragment the physical pages, leaving B with a copy of what A used to own? Or, perhaps process B requests so much memory that the texture space requested by process A gets paged out to main memory?
Nothing new here. (Score:2)
Previous allocated memory huh? (Score:1)
Absolutely! (Score:1)
Also happens on Mac OS (Score:1)
Even on my Mac OS, running Minecraft, I see this. When Minecraft starts up, it opens a window, displays what ever is in the graphics memory, and then eventually clears it out and shows it's welcome window.
That graphics memory can be anything from screen rendering pieces, to other window data, etc.
I wonder if anything would survive a logout, and then someone else logging in?
Re: (Score:2)
Graphic memory doesn't just survive logouts, it survives soft-reboots as well (e.g. the login screen in Linux likes to show garbage from the previous boot). To clear the memory you have to switch of the computer completely.
Re: (Score:1)
It's because the bug is in NVidia drivers, not in the application.
Re: (Score:2)