7 ms·

Attacking the Qualcomm Adreno GPU

63 points by archimag0 6y ago

nl 6y ago
Next time Project Zero finds an iOS bug and people suggest it is a commercial hitjob, point them at this. Qualcomm (and all Android vendors) look like they have been screwed by this. (To be clear - they are screwed because their processes are to slow to get security updates out).
- panpanna 6y ago
  Maybe you have not used Android lately? I have two phones and a tablet, all mid-range devices from 3 different vendors and all are on Android 10 with at least August patches. Edit: both phones are also more than 2 years old.
  - nl 6y ago
    I have a Pixel. My comment referred to the timeline outlined in the post, in particular this part: Qualcomm gives an update on the progress of a microcode based fix. The plan is that the fix will be available for OEMs by September 7, but Qualcomm will request an extension to patch integration and testing by OEMs.allow more time for patch integration and testing by OEMs. and for their multiple subsequent requests for an extension and/or grace period. Your August patches don't fix this - Qualcomm only notified OEMs on 4 August and their plan was to get fixes to OEMs by 7 Sep.
    - panpanna 6y ago
      I am fine with this schedule. Unless someone is actively exploiting devices I would prefer a well tested patch to a rushed patch. Note that this whole issue is due a previously rushed patch.
      - nl 6y ago
        It wasn't due to a rushed patch - the patch just gave the Project Zero researcher an idea for where he should look. There's no real way of being sure if it is being exploited. I guess no exploits had been detected a couple of days ago, but it's not uncommon for the way it gets detected it for someone to find the exploit software somewhere. That's how Project Zero found these iOS issues for example[1]. [1] https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
  - londons_explore 6y ago
    For comparison, Google Chrome tries to get security patches to most users within 24 hours. Yet most android devices are lucky to receive a patch within a few months... Don't worry though - that's only a window of a few months where an evil actor can drain your bank account and log your porn browsing sessions...
    - saagarjha 6y ago
      As someone using iOS, does Chrome really update multiple times a week for security patches? Am I overestimating how often security fixes go in?
      - londons_explore 6y ago
        Critical security issues 'in the wild' only come up once every few months, but yes, when they do, the Chrome team has someone on duty 24 hours per day whose responsibility is to patch the code and do a release to all users within a matter of hours. If you submit a security issue to Chrome, they actually have a tickbox on the webform to say "this issue is important enough to get someone out of bed for", and if you tick that box, it will actually wake someone at 3am to deal with it...
- GeekyBear 6y ago
  You should probably wait for an example where Google didn't put off writing the issue up for a year after the initial report.
  - nl 6y ago
    What does this mean? They (Project Zero) only started working on this in June 2020 (" However in June 2020, I noticed that the patch for CVE-2019-10567 was incomplete, and worked with Qualcomm's security team and GPU engineers to fix the issue at its root cause.... It's our understanding that Qualcomm will list this publicly in their November 2020 bulletin.")
baybal2 6y ago
Guang Gong keeps disclosing many remote Chromium/Android zero click vulns, every year, which could've earned him millions on zerodium, and even more if put to real use. Deserves respect at least.
- person_of_color 6y ago
  He will be getting the same at GPZ, trust me.
panpanna 6y ago
At least the GPU stuff is getting some scrutiny. Their modem code is a security nightmare and outside Qualcomms modem teams nobody is allowed to see it.
- octoberfranklin 6y ago
  Yeah I think it is pretty nuts that people are willing to use CPUs that have those modems on the same die.
  - londons_explore 6y ago
    The simple solution is memory isolation - let the modem be as insecure as you like, but anyone who breaks into the modem can only see your network traffic (hopefully all encrypted anyway) and nothing else. Sadly todays qualcomm hardware has no real memory isolation at all - any bit of on-chip hardware can see all memory. It isn't perfect, but it's far easier to do that than properly secure a multi-million lines of code codebase with a substantial amount of unpatchable hardware...
    - panpanna 6y ago
      There is definitely memory protection in the modem. If nothing else because the code is so horrible it crashes all the time. Three is even a hypervisor for hexagon but I don't think it is used.
      - londons_explore 6y ago
        As someone else said, it's not a security barrier between the ARM core and the radio hardware bits... It's more a tool for remapping stuff to make system design easier, and as a way of protecting against evil hardware outside the SoC. I believe it can prevent the ARM core tampering with private radio hardware memory, but not the other way round.
        panpanna 6y ago
guerby 6y ago
"We can offer a few additional recommendations: Transparency and openness: (...) More generally, the competitive benefits of a closed platform approach to hardware internals should be reassessed in 2020. This balance may have been historically appropriate when the GPU was not in the critical path for security, but today billions of users are relying on the GPU to uphold the operating system security model. " This.

63 points by archimag0 6y ago

nl 6y ago

Next time Project Zero finds an iOS bug and people suggest it is a commercial hitjob, point them at this. Qualcomm (and all Android vendors) look like they have been screwed by this. (To be clear - they are screwed because their processes are to slow to get security updates out).

panpanna 6y ago
Maybe you have not used Android lately? I have two phones and a tablet, all mid-range devices from 3 different vendors and all are on Android 10 with at least August patches. Edit: both phones are also more than 2 years old.
- nl 6y ago
  I have a Pixel. My comment referred to the timeline outlined in the post, in particular this part: Qualcomm gives an update on the progress of a microcode based fix. The plan is that the fix will be available for OEMs by September 7, but Qualcomm will request an extension to patch integration and testing by OEMs.allow more time for patch integration and testing by OEMs. and for their multiple subsequent requests for an extension and/or grace period. Your August patches don't fix this - Qualcomm only notified OEMs on 4 August and their plan was to get fixes to OEMs by 7 Sep.
  - panpanna 6y ago
    I am fine with this schedule. Unless someone is actively exploiting devices I would prefer a well tested patch to a rushed patch. Note that this whole issue is due a previously rushed patch.
    - nl 6y ago
      It wasn't due to a rushed patch - the patch just gave the Project Zero researcher an idea for where he should look. There's no real way of being sure if it is being exploited. I guess no exploits had been detected a couple of days ago, but it's not uncommon for the way it gets detected it for someone to find the exploit software somewhere. That's how Project Zero found these iOS issues for example[1]. [1] https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
- londons_explore 6y ago
  For comparison, Google Chrome tries to get security patches to most users within 24 hours. Yet most android devices are lucky to receive a patch within a few months... Don't worry though - that's only a window of a few months where an evil actor can drain your bank account and log your porn browsing sessions...
  - saagarjha 6y ago
    As someone using iOS, does Chrome really update multiple times a week for security patches? Am I overestimating how often security fixes go in?
    - londons_explore 6y ago
      Critical security issues 'in the wild' only come up once every few months, but yes, when they do, the Chrome team has someone on duty 24 hours per day whose responsibility is to patch the code and do a release to all users within a matter of hours. If you submit a security issue to Chrome, they actually have a tickbox on the webform to say "this issue is important enough to get someone out of bed for", and if you tick that box, it will actually wake someone at 3am to deal with it...
GeekyBear 6y ago
You should probably wait for an example where Google didn't put off writing the issue up for a year after the initial report.
- nl 6y ago
  What does this mean? They (Project Zero) only started working on this in June 2020 (" However in June 2020, I noticed that the patch for CVE-2019-10567 was incomplete, and worked with Qualcomm's security team and GPU engineers to fix the issue at its root cause.... It's our understanding that Qualcomm will list this publicly in their November 2020 bulletin.")

baybal2 6y ago

Guang Gong keeps disclosing many remote Chromium/Android zero click vulns, every year, which could've earned him millions on zerodium, and even more if put to real use. Deserves respect at least.

person_of_color 6y ago
He will be getting the same at GPZ, trust me.

panpanna 6y ago

At least the GPU stuff is getting some scrutiny. Their modem code is a security nightmare and outside Qualcomms modem teams nobody is allowed to see it.

octoberfranklin 6y ago
Yeah I think it is pretty nuts that people are willing to use CPUs that have those modems on the same die.
- londons_explore 6y ago
  The simple solution is memory isolation - let the modem be as insecure as you like, but anyone who breaks into the modem can only see your network traffic (hopefully all encrypted anyway) and nothing else. Sadly todays qualcomm hardware has no real memory isolation at all - any bit of on-chip hardware can see all memory. It isn't perfect, but it's far easier to do that than properly secure a multi-million lines of code codebase with a substantial amount of unpatchable hardware...
  - panpanna 6y ago
    There is definitely memory protection in the modem. If nothing else because the code is so horrible it crashes all the time. Three is even a hypervisor for hexagon but I don't think it is used.
    - londons_explore 6y ago
      As someone else said, it's not a security barrier between the ARM core and the radio hardware bits... It's more a tool for remapping stuff to make system design easier, and as a way of protecting against evil hardware outside the SoC. I believe it can prevent the ARM core tampering with private radio hardware memory, but not the other way round.
      - panpanna 6y ago

guerby 6y ago

"We can offer a few additional recommendations: Transparency and openness: (...) More generally, the competitive benefits of a closed platform approach to hardware internals should be reassessed in 2020. This balance may have been historically appropriate when the GPU was not in the critical path for security, but today billions of users are relying on the GPU to uphold the operating system security model. " This.