More Details On Intel's CVE-2019-14615 Graphics Vulnerability, a.k.a. iGPU Leak
Written by Michael Larabel in Intel on 18 January 2020 at 02:52 PM EST. 9 Comments
INTEL --
As for CVE-2019-14615 the Intel graphics vulnerability disclosed this week affecting Gen7 through Gen9 graphics architectures, it's been dubbed "iGPU Leak" by the researchers involved. Thanks to the researcher who originally discovered this vulnerability having reached out to us, we now have some more information on this issue they describe as a "dangerous vulnerability."

This is the vulnerability that initially piqued our interest over the big graphics performance hit to older Ivybridge/Haswell processors with integrated graphics where in the initial patches we've seen quite dramatic losses.. Fortunately though the current Gen9 graphics have a mitigation where we're seeing fortunately no change in performance. As relayed yesterday, however, they hope for no Gen7 graphics performance penalty in the final version of their mitigation.

CVE-2019-14615 was discovered by researchers at Hong Kong University of Science and Technology in cooperation with the Indian Institute of Technology Goa and the University of North Carolina at Chapel Hill. They dub this vulnerability "iGPU Leak" and describe it as an information leakage vulnerability on the Intel integrated GPU architecture.


The iGPU Leak vulnerability covers both GPU register leaking and GPU shared local memory leaks. One of our initial concerns when hearing of this vulnerability originally is whether it could be exposed via WebGL for attacks via the web browsers. The researchers do mention that the extent of the browser vulnerability appears to be with website fingerprinting attacks for identifying users but at least not compromising their system data.


But as for attacks with local software, iGPU Leak could be used for objectives like AES attacks.


The researchers proposed mitigation for iGPU leak is kernel-based mitigation of flushing the GPU between jobs, similar to what Intel has employed with their driver patches this week. But the researchers acknowledge it comes with a performance cost. At least for Gen9 that performance cost doesn't appear visible but for Gen7 certainly it does while Intel hopes to close that gap. The researchers also talk of potentially using a user-space mitigation for iGPU Leak, but that wouldn't fix the fundamental issue at hand and still could leave the system open to attack by rogue user-space drivers.


The researchers believe iGPU leak is a "dangerous vulnerability." The vulnerability was originally discovered in July while around September is when Intel was notified of this problem and then made public this past Tuesday.

The researchers have released demo code of the shared local memory and GRF register leakage attack vectors with this sample code. The code is intended to run on Linux with Intel graphics and does depend upon OpenCL support on the system for this implementation. Videos demonstrating iGPU Leak are below.



That's the latest we know on iGPU Leak.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Popular News This Week