Security researchers discover vulnerability in Apple, AMD, and Qualcomm GPU architectures enabling unauthorized GPU memory access.

A design flaw in GPU drivers made by Apple, Qualcomm, AMD, and likely Imagination can be exploited by users on a shared system to snoop on fellow users and observe the large language models and other machine-learning software being accelerated by those processors. The vulnerability, tracked as CVE-2023-4969 and dubbed LeftoverLocals, was discovered by Tyler Sorensen, a security research engineer on the Trail of Bits AI and ML assurance team and an assistant professor at University of California, Santa Cruz. Graphics chips and their drivers are supposed to prevent this kind of monitoring by fully isolating the memory and other resources used by each user process from one another, but many do not securely implement this functionality sufficiently, allowing data to be stolen. Research made public on Tuesday detailed how miscreants can exploit the hole to read data they're not supposed to in a system's local GPU memory, with proof-of-concept code demonstrating how to snoop on an LLM chatbot in conversation with another user on a shared GPU-accelerated box.

To exploit the security oversight, an attacker needs sufficient access to a shared GPU to run application code on it. That code, despite any isolation protections in place, can mine local memory for areas used by other programs as a data cache, allowing the attacker to inspect these cache areas for values written by other users and processes and exfiltrate that information. Each cache should ideally be wiped after a program finishes using it, but this deletion does not automatically happen, allowing other applications on the GPU to observe the leftover contents—hence the name, LeftoverLocals. As Sorensen and Heidy Khlaaf, Trail of Bits' engineering director for AI and ML assurance, noted, "This data leaking can have severe security consequences, especially given the rise of ML systems, where local memory is used to store model inputs, outputs, and weights."

The potential data loss from this vulnerability is substantial, particularly for machine-learning applications. "LeftoverLocals can leak ~5.5 MB per GPU invocation on an AMD Radeon RX 7900 XT which, when running a 7B model on llama.cpp, adds up to ~181 MB for each LLM query," Sorensen and Khlaaf explained. "This is enough information to reconstruct the LLM response with high precision." The bug hunters have been working with affected GPU vendors and the CERT Coordination Center to address and disclose the flaws since September 2023. AMD plans to begin rolling out mitigations in March through upcoming driver updates and confirmed that numerous products are vulnerable, including multiple versions of its Athlon and Ryzen desktop and mobile processors, Radeon graphics cards, and Radeon and Instinct data center GPUs. Apple stated its M3 and A17 series processors have fixes for the vulnerability but declined to comment on researchers' assessment that "the issue still appears to be present on the Apple MacBook Air (M2)," though "the recently released Apple iPhone 15 does not appear to be impacted as previous versions have been." Google released fixes for ChromeOS devices with impacted AMD and Qualcomm GPUs as part of the 120 and 114 releases in the Stable and LTS channels, respectively. Qualcomm issued a firmware patch, though according to researchers it only fixes the issue for some devices.

Nvidia and Arm are not said to be affected. Since loads of AI accelerators in the cloud come from Nvidia, users training or running on those systems will be unaffected. However, Apple, Imagination, and Qualcomm are not known for their presence in public cloud GPU pools, so the risk there is limited.