Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attacking the Windows Nvidia Driver

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

31–40 of 77 posts

Re: Attacking the Windows Nvidia Driver

#31

Post by vvanders »

edmccard wrote: post #30
vvanders wrote: post #26

Earlier quoted context omitted.

I think there's probably still a fair bit of attack surface behind glReadPixels() and the like. All it takes in a single backbuffer/texture/surface/etc to not be memzero'd properly and you can start looking at parts of the system's memory. GPUs are both really complex and highly secretive about their implementations. The incentive for GPU vendors is to write fast drivers. Security is pretty far down on the list, esp…

>fair bit of attack surface behind glReadPixels() and the like... >...you can start looking at parts of the system's memory I thought the whole point of using glReadPixels(), as opposed to just dereferencing a pointer in the system's address space, was that the framebuffer memory it accesses (whether backed by a texture or a surface or whatever) is GPU memory, and not system memory?

That's true on split-memory architectures(desktop) but most mobile GPUs(and a couple consoles) use a unified memory model.

Also most browsers use the GPU to speed up rendering so you can pick out things from there too potentially.

Re: Attacking the Windows Nvidia Driver

#32

Post by __jal »

realharo wrote: post #8
hatsunearu wrote: post #4

Earlier quoted context omitted.

Oh trust me, they do tons of QA. If you can replicate what problem you have demonstrably with steps that QA can follow and you submit to the Nvforums or whatever, someone in the QA team will eventually try it out.

I dunno, I have had to live with this bug ( https://forums.geforce.com/default/topic/953432/geforce-mobi... , https://answers.microsoft.com/en-us/windows/forum/windows_10... ) for over half a year now.

Yeah, Nvidia rather sucks at cleaning up after themselves, for whatever reason.

The main reason I'm not buying another card from them is their stance towards Linux in general and their stance towards PCI virtualization in particular.

I'm currently not upgrading drivers due to the latter; they're trying to disable the capabilities (dedicating a card to a VM) that are the reason I bought a second card in the first place.

I can usually deal with either lazy or greedy, but both in conjunction is infuriating. Screw those guys.

Re: Attacking the Windows Nvidia Driver

#33

Post by diamondlovesyou »

drbawb wrote: post #25
AlwaysRock wrote: post #2

I cant prove this but my computer blue screened after a Nvidia driver update. It took my several hours to get everything working again because it wouldnt even launch in safe mode. Very frustrating. I wish they had a little more quality control on their drivers.

I ran into this a while back, there was a BSOD in the GTX 980Ti drivers that only got triggered by multi-monitor setups. Hilariously the solution was to use a newer beta driver that hadn't passed WHQL yet. (Rolling back would've worked as well, but I was updating specifically because there was a bug in the previous driver. WebMs in Chrome would start out mostly black w/ fuzzy blocks and after a loop of the content th…

Interesting. I have an AMD card and experience that too.

Re: Attacking the Windows Nvidia Driver

#34

Post by oxide »

and0 wrote: post #29
rebelwebmaster wrote: post #17

Getting these issues fixed in the drivers is great, no doubt. But it's moot if nobody actually updates to those fixed versions. How hard are nVidia/Microsoft trying to actually push these out over Windows Update so that end users will actually benefit from all of this work?

Anyone who's into gaming probably has GeForce Experience installed, which manages drivers and gives notifications. I want to say Microsoft will push them out a little later, but I can't be entirely sure since I've always used the nVidia path. EDIT: Unfortunately the GeForce Experience is getting, as is typical, super invasive. Access to even basic settings requires an account (nVidia or Facebook account, etc).

notifications for new drivers are nice, but I'll get around to updating them anyway without notifications. Geforce Experience is terrible. The more invasive it gets, the less I want it installed.

Re: Attacking the Windows Nvidia Driver

#35

Post by mschuster91 »

What I'd like to see is a "slimmed down" version of the graphics drivers.

Right now my graphics driver carries a boatload of "utilities" of questionable utility - especially "hand written artisanal shaders" to improve quality in AAA titles, where NV or ATI optimize the game's original shaders. NVIDIA ships stuff for 3D glasses.

How about that the driver packages only load these when asked to do so, e.g. when a game that can be optimized is installed / launched, or when a 3D glass is added?

Re: Attacking the Windows Nvidia Driver

#36

Post by Eridrus »

vvanders wrote: post #26
Eridrus wrote: post #20

Earlier quoted context omitted.

They were right that it was dangerous, but it became pretty clear that IE was using them to provide cover for not implementing a feature when they changed their mind later. Whereas Chrome implemented a WebGL compiler that reduced the amount of attack surface WebGL could reach and audited a bunch of popular drivers to fix the exposed bits. I think the fact that this blog shows that these vulnerabilities are not reacha…

I think there's probably still a fair bit of attack surface behind glReadPixels() and the like. All it takes in a single backbuffer/texture/surface/etc to not be memzero'd properly and you can start looking at parts of the system's memory. GPUs are both really complex and highly secretive about their implementations. The incentive for GPU vendors is to write fast drivers. Security is pretty far down on the list, esp…

There's a nonzero risk there, but this seems like a relatively narrow problem that would be much trickier to exploit than any memory corruption bug.

Re: Attacking the Windows Nvidia Driver

#37

Post by bonzini »

__jal wrote: post #32
realharo wrote: post #8

Earlier quoted context omitted.

I dunno, I have had to live with this bug ( https://forums.geforce.com/default/topic/953432/geforce-mobi... , https://answers.microsoft.com/en-us/windows/forum/windows_10... ) for over half a year now.

Yeah, Nvidia rather sucks at cleaning up after themselves, for whatever reason. The main reason I'm not buying another card from them is their stance towards Linux in general and their stance towards PCI virtualization in particular. I'm currently not upgrading drivers due to the latter; they're trying to disable the capabilities (dedicating a card to a VM) that are the reason I bought a second card in the first plac…

If you're talking about GPU pass-through, they're just trying to make it hard, but they're not making it impossible.

If you're talking about virtual GPUs, where one card is split across multiple VMs, however, unfortunately that's Tesla only. That said, I worked (as the maintainer of KVM) with the nVidia driver people working on vGPU, and I was very impressed. They were very knowledgeable and professional, and they managed to contribute a generic Linux framework for virtualizing PCI devices rather than a one-off hack specific to nVidia. Intel is using the same framework now, in fact.

Re: Attacking the Windows Nvidia Driver

#38

Post by influx »

oridecon wrote: post #22
jcadam wrote: post #19

Earlier quoted context omitted.

I once interviewed for a Software Engineering role with an Nvidia QA team in Austin 5 or 6 years ago(would have been working on maintaining the test software that validated new drivers on huge banks of test hardware, if memory serves). Wasn't too terribly impressed with the team (and a couple of them were definitely giving off that "I hate my job/life" vibe, one disgruntled fellow was even trying to drop little thinl…

After the "Tom" incident I'm not surprised to hear about anything that happens inside NVIDIA. That presentation, months of bad drivers (yes, I was using DDU) and the GFExperience login thing made me switch to another brand.

I didn't know what the "Tom" incident was, but assume it is this, which is deplorable:

https://www.youtube.com/watch?v=bGrvahez1H8&feature=youtu.be

Re: Attacking the Windows Nvidia Driver

#39

Post by yuhong »

bonzini wrote: post #37
__jal wrote: post #32

Earlier quoted context omitted.

Yeah, Nvidia rather sucks at cleaning up after themselves, for whatever reason. The main reason I'm not buying another card from them is their stance towards Linux in general and their stance towards PCI virtualization in particular. I'm currently not upgrading drivers due to the latter; they're trying to disable the capabilities (dedicating a card to a VM) that are the reason I bought a second card in the first plac…

If you're talking about GPU pass-through, they're just trying to make it hard, but they're not making it impossible. If you're talking about virtual GPUs, where one card is split across multiple VMs, however, unfortunately that's Tesla only. That said, I worked (as the maintainer of KVM) with the nVidia driver people working on vGPU, and I was very impressed. They were very knowledgeable and professional, and they ma…

I think they want to limit it to Quadros to be more precise.

Re: Attacking the Windows Nvidia Driver

#40

Post by Raphmedia »

AlwaysRock wrote: post #2

I cant prove this but my computer blue screened after a Nvidia driver update. It took my several hours to get everything working again because it wouldnt even launch in safe mode. Very frustrating. I wish they had a little more quality control on their drivers.

I often have the issue with their "clean install" option where it uninstall the current driver, reboot, fail to boot because there are no drivers and don't install the current version. Very frustrating.
Post reply on HN