More Details On Intel's CVE-2019-14615 Graphics Vulnerability, a.k.a. iGPU Leak

As for CVE-2019-14615 the Intel graphics vulnerability disclosed this week affecting Gen7 through Gen9 graphics architectures, it's been dubbed "iGPU Leak" by the researchers involved. Thanks to the researcher who originally discovered this vulnerability having reached out to us, we now have some more information on this issue they describe as a "dangerous vulnerability."

This is the vulnerability that initially piqued our interest over the big graphics performance hit to older Ivybridge/Haswell processors with integrated graphics where in the initial patches we've seen quite dramatic losses.. Fortunately though the current Gen9 graphics have a mitigation where we're seeing fortunately no change in performance. As relayed yesterday, however, they hope for no Gen7 graphics performance penalty in the final version of their mitigation.

CVE-2019-14615 was discovered by researchers at Hong Kong University of Science and Technology in cooperation with the Indian Institute of Technology Goa and the University of North Carolina at Chapel Hill. They dub this vulnerability "iGPU Leak" and describe it as an information leakage vulnerability on the Intel integrated GPU architecture.

The iGPU Leak vulnerability covers both GPU register leaking and GPU shared local memory leaks. One of our initial concerns when hearing of this vulnerability originally is whether it could be exposed via WebGL for attacks via the web browsers. The researchers do mention that the extent of the browser vulnerability appears to be with website fingerprinting attacks for identifying users but at least not compromising their system data.

But as for attacks with local software, iGPU Leak could be used for objectives like AES attacks.

The researchers proposed mitigation for iGPU leak is kernel-based mitigation of flushing the GPU between jobs, similar to what Intel has employed with their driver patches this week. But the researchers acknowledge it comes with a performance cost. At least for Gen9 that performance cost doesn't appear visible but for Gen7 certainly it does while Intel hopes to close that gap. The researchers also talk of potentially using a user-space mitigation for iGPU Leak, but that wouldn't fix the fundamental issue at hand and still could leave the system open to attack by rogue user-space drivers.

The researchers believe iGPU leak is a "dangerous vulnerability." The vulnerability was originally discovered in July while around September is when Intel was notified of this problem and then made public this past Tuesday.

The researchers have released demo code of the shared local memory and GRF register leakage attack vectors with this sample code. The code is intended to run on Linux with Intel graphics and does depend upon OpenCL support on the system for this implementation. Videos demonstrating iGPU Leak are below.

That's the latest we know on iGPU Leak.