LeftoverLocals: Listening to LLM responses through leaked GPU local memory
blog.trailofbits.com
LeftoverLocals: Listening to LLM responses through leaked GPU local memory
1–10 of 42 posts
Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory
#2[deleted]
Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory
#3tl;dr GPU drivers made by various vendors do not sanitize compute unit hardware scratch memory between uses, so you can just freely read whatever the last user left laying around when they stopped.
Literally too incompetent to follow even basic security 101 practices. A time shared device must be sanitized between users to prevent state leakage. There is no reason to believe that a security culture that clueless when developing a universally shared, high criticality device can be believed if they claim to do better elsewhere. Their process is either so incompetent or so inconsistent that their claims can not be believed without external audits.
In this case: Apple, Qualcomm, AMD, Imagination.
Edit: Added Imagination as noted by reply.
Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory
#4tl;dr GPU drivers made by various vendors do not sanitize compute unit hardware scratch memory between uses, so you can just freely read whatever the last user left laying around when they stopped. Literally too incompetent to follow even basic security 101 practices. A time shared device must be sanitized between users to prevent state leakage. There is no reason to believe that a security culture that clueless when…
And Imagination.
Notably Intel and Nvidia were not impacted. I wonder if the security hardening that Google worked on with Nvidia for Stadia helped prevent this
Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory
#5tl;dr GPU drivers made by various vendors do not sanitize compute unit hardware scratch memory between uses, so you can just freely read whatever the last user left laying around when they stopped. Literally too incompetent to follow even basic security 101 practices. A time shared device must be sanitized between users to prevent state leakage. There is no reason to believe that a security culture that clueless when…
Wasn't too long ago that stray texture data would be left lying around from other processes, too. You could exploit that to read the contents of the user's banking tabs and stuff like that.
Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory
#6tl;dr GPU drivers made by various vendors do not sanitize compute unit hardware scratch memory between uses, so you can just freely read whatever the last user left laying around when they stopped. Literally too incompetent to follow even basic security 101 practices. A time shared device must be sanitized between users to prevent state leakage. There is no reason to believe that a security culture that clueless when…
And Imagination. Notably Intel and Nvidia were not impacted. I wonder if the security hardening that Google worked on with Nvidia for Stadia helped prevent this
Could imagine it being related to CUDA as well. Memory being consistently zero-initialized helps prevent application bugs.
Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory
#7tl;dr GPU drivers made by various vendors do not sanitize compute unit hardware scratch memory between uses, so you can just freely read whatever the last user left laying around when they stopped. Literally too incompetent to follow even basic security 101 practices. A time shared device must be sanitized between users to prevent state leakage. There is no reason to believe that a security culture that clueless when…
And Imagination. Notably Intel and Nvidia were not impacted. I wonder if the security hardening that Google worked on with Nvidia for Stadia helped prevent this
Jeez, I hope it did not require “security hardening” for Nvidia to do something this basic. If these other vendors missed some tiny corner resulting in state leakage, that would be understandable. But, forgetting to clear local memory is just inexcusable.
Imagine a OS forgetting to replace your general purpose registers across context switches. Only a rank incompetent and useless security process would let something like that get all the way through to deployment.
Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory
#8I've been told that historically performance has been prioritized over security in the GPU space. Mitigating things like this does incur a performance penalty.
Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory
#9> Since September 2023, we have been working with CERT (..)
> Apple: Despite multiple efforts to establish contact through CERT/CC, we only received a response from Apple on January 13, 2024.
> Apple did not respond or engage with us regarding the disclosure.
Well at least they are consistent at not giving a flying f*ck about working with bug reporters, no matter who you are. I have reported 5+ radars in the past and have never received any response, not even a confirmation.
Re: LeftoverLocals: Listening to LLM responses through leaked GPU local memory
#10tl;dr GPU drivers made by various vendors do not sanitize compute unit hardware scratch memory between uses, so you can just freely read whatever the last user left laying around when they stopped. Literally too incompetent to follow even basic security 101 practices. A time shared device must be sanitized between users to prevent state leakage. There is no reason to believe that a security culture that clueless when…
It's not so simple.
For example Windows takes over GPU memory control, it virtualizes it, and allocates it to various applications, zeros it, etc...