<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - Sanitize all freed GPU memory"
href="https://bugs.freedesktop.org/show_bug.cgi?id=74532">74532</a>
</td>
</tr>
<tr>
<th>Keywords</th>
<td>security
</td>
</tr>
<tr>
<th>Assignee</th>
<td>dri-devel@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Summary</th>
<td>Sanitize all freed GPU memory
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux (All)
</td>
</tr>
<tr>
<th>Reporter</th>
<td>nikoli@gmx.us
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Component</th>
<td>General
</td>
</tr>
<tr>
<th>Product</th>
<td>DRI
</td>
</tr></table>
<p>
<div>
<pre>X11 applications are able to get and display in human readable form parts of
closed applications, see:
<a href="https://github.com/mpv-player/mpv/issues/521">https://github.com/mpv-player/mpv/issues/521</a>
It means applications like skype can silently send much more data, then you
expect, even when you run them as separate user.
Asked about this security problem in #gentoo-hardened, #radeon and #dri-devel,
summarizing:
0) Currently GPU memory is not sanitized by kernel, nothing enforces and
ensures its sanitizing.
1) <a href="https://grsecurity.net">https://grsecurity.net</a> Linux kernel patches add ability to sanitize all
freed memory, but they do not affect GPU memory:
<a href="https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options#Sanitize_all_freed_memory">https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options#Sanitize_all_freed_memory</a>
2) The only secure place to clean memory is kernel, because if application or X
server crashes, memory will not be erased.
3) Some applications possibly will work slower, so better make sanitizing
configurable by adding build and run time kernel options.
4) Most likely this problem affects opencl too.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>