Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

hsmr.cc

Post reply on HN
Print view View original

11–20 of 47 posts

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#11

Post by brtmr »

lxgr wrote: post #10

This is an issue for any software that is able to access the GPU: http://blog.lxgr.net/tag/opengl.html

Yes, that is the exact same issue. While searching for any prior art, i did not find your blog post, but the problem seemed far too obvious for me to be the only one to have ever stumbled upon it. I do think this issue needs some exposure, there seem to be a lot of potential security ramifications.

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#12

Post by exDM69 »

brtmr wrote: post #9
_wmd wrote: post #8

Does this have any bearing on WebGL?

The webgl standard has rather strong memory safety considerations: WebGL resources such as textures and vertex buffer objects (VBOs) must always contain initialized data, even if they were created without initial user data values.[0] As long as browser vendors implement this (and chrome and firefox seem to), this should not be an issue. [0] https://www.khronos.org/registry/webgl/specs/1.0.3/

This was a problem with WebGL a few years ago on some OS/GPU/Browser combinations. It was possible to write a WebGL app that created uninitialized textures, drew them on screen, grabbed a screenshot and then uploaded that via HTTP(s) to a server.

This issue should now be fixed, but bugs and/or old unpatched browsers may still be out there.

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#15

Post by brtmr »

plicense wrote: post #4

I recently wrote a library that rasterizes a PDF page to an image and was observing a very similar behavior. It was also highly system dependent and erratic as well. I would randomly see a distorted image of my own screen when I run my program on any PDF. Then figured out I was not initializing the buffer I was using to render the PDF page to image. After I memset'ed it to zero, the problem went away. I still couldn'…

Yes, this is the same way I found this - In the course of another project I had the same "Huh, this is weird" moment. Then I started experimenting with different setups (Linux, Windows, VMs) and was surprised that I apparently almost always succeeded in recovering stuff.

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#16

Post by zurn »

lxgr wrote: post #10

This is an issue for any software that is able to access the GPU: http://blog.lxgr.net/tag/opengl.html

Just in components that claim to provide security boundaries but then do OpenGL passthrough without precautions. Web browsers handle this this properly in WebGL. VirtualBox is at fault here.

Your linked article is about just running two native desktop apps side by side under the same user account, there isn't any supposed security boundary between them so it's a different case.

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#18

Post by viclou »

I've noticed something similar playing Mini Metro last month.

I was running a Windows 7 VM on an OS X 10.9.5 host with Virtualbox 4.2.28 using my mid 2013 Macbook Air (Intel HD Graphics 5000 1024 MB). Instead of blurring the game for the weekly upgrade menu, it showed the center of my host desktop wallpaper, upside-down and flipped (other than that, there was distortion whatsoever). It really creeped me out.

http://i.imgur.com/OqYvYjq.png

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#19

Post by thegeomaster »

Something similar happened to me, but with a different scenario. I hibernated my Arch Linux system and then booted into Windows (I unmount all of my NTFS partitions beforehand), did some work, and then rebooted into Linux again. The GNOME lock screen doesn't play nice with my NVIDIA drivers (closed-source), so it doesn't reinitialize the lock screen texture when it wakes up from suspend-to-RAM or suspend-to-disk. The lock screen now sported a portion of the desktop from the Windows system which was shut down before. It was a really interesting thing to see, but a bit unsettling too. Lots of surface for information leakage through VRAM, it seems.

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#20

Post by brtmr »

zurn wrote: post #16
lxgr wrote: post #10

This is an issue for any software that is able to access the GPU: http://blog.lxgr.net/tag/opengl.html

Just in components that claim to provide security boundaries but then do OpenGL passthrough without precautions. Web browsers handle this this properly in WebGL. VirtualBox is at fault here. Your linked article is about just running two native desktop apps side by side under the same user account, there isn't any supposed security boundary between them so it's a different case.

Oracle also discourages the use of 3D acceleration for untrusted hosts. See here: http://www.virtualbox.org/manual/ch04.html#guestadd-3d
Post reply on HN