Attacking the Qualcomm Adreno GPU • Hacker News Board

Re: Attacking the Qualcomm Adreno GPU

#21

Post by nl » Thu, Sep 10, 2020, 2:06 AM UTC

panpanna wrote: post #14

nl wrote: post #7

Earlier quoted context omitted.

I have a Pixel. My comment referred to the timeline outlined in the post, in particular this part: Qualcomm gives an update on the progress of a microcode based fix. The plan is that the fix will be available for OEMs by September 7, but Qualcomm will request an extension to patch integration and testing by OEMs.allow more time for patch integration and testing by OEMs. and for their multiple subsequent requests for…

I am fine with this schedule. Unless someone is actively exploiting devices I would prefer a well tested patch to a rushed patch. Note that this whole issue is due a previously rushed patch.

It wasn't due to a rushed patch - the patch just gave the Project Zero researcher an idea for where he should look.

There's no real way of being sure if it is being exploited. I guess no exploits had been detected a couple of days ago, but it's not uncommon for the way it gets detected it for someone to find the exploit software somewhere. That's how Project Zero found these iOS issues for example[1].

[1] https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...

Re: Attacking the Qualcomm Adreno GPU

#22

Post by nl » Thu, Sep 10, 2020, 2:12 AM UTC

GeekyBear wrote: post #19

nl wrote: post #2

Next time Project Zero finds an iOS bug and people suggest it is a commercial hitjob, point them at this. Qualcomm (and all Android vendors) look like they have been screwed by this. (To be clear - they are screwed because their processes are to slow to get security updates out).

You should probably wait for an example where Google didn't put off writing the issue up for a year after the initial report.

What does this mean? They (Project Zero) only started working on this in June 2020 (" However in June 2020, I noticed that the patch for CVE-2019-10567 was incomplete, and worked with Qualcomm's security team and GPU engineers to fix the issue at its root cause.... It's our understanding that Qualcomm will list this publicly in their November 2020 bulletin.")

Re: Attacking the Qualcomm Adreno GPU

#23

Post by octoberfranklin » Thu, Sep 10, 2020, 11:50 AM UTC

baybal2 wrote: post #15

londons_explore wrote: post #8

Earlier quoted context omitted.

The simple solution is memory isolation - let the modem be as insecure as you like, but anyone who breaks into the modem can only see your network traffic (hopefully all encrypted anyway) and nothing else. Sadly todays qualcomm hardware has no real memory isolation at all - any bit of on-chip hardware can see all memory. It isn't perfect, but it's far easier to do that than properly secure a multi-million lines of co…

There is an IOMMU on snapdragons, as the article says, but it is the IOMMU mapping itself which they attack. This itself is kind of mind boggling how they let the device overwrite its own IOMMU configuration, effectively nullifying IOMMU's purpose, and its provided safeties. It's like fencing your house with 10 meter high walls, but leaving the key lying in front of the gate.

So, like you say: they don't have an IOMMU, although they have some dingus which is called an "IOMMU".