Today, almost all desktop and most mobile operating systems and devices support some version of OpenGL. I'm wondering about the security implications of that:
- In many cases, the GPU has complete and unrestricted access to the main memory (for integrated graphic devices) or at least the video RAM, where sensitive information might also be stored (think compositing window managers or hardware-accelerated web browsers).
- In some implementations, OpenGL clients communicate with the GPU by directly writing data and commands to shared memory.
- Only recent GPUs seem to support memory virtualization, and even then, only some driver implementations are currently using it.
- WebGL requires newly allocated buffer objects to be zero-initialized; I suspect that this means that this is not required in standard OpenGL. Does that mean that it is theoretically possible to allocate a buffer in video memory and read potentially security sensitive data?
So who or what keeps me from writing a shader program that reads data in the video or even main memory that doesn't belong to me?
I've found a presentation on the current state of affairs in the Linux graphics system which mentions that either the commands to the GPU are verified by the kernel, or that virtual memory is used on the GPU to separate users.
Is that also true for other, especially mobile, operating systems like Android, where the individual applications are strongly sandboxed, but have almost unlimited OpenGL access? Tegra 2 is even specifically mentioned in that presentation for allowing potentially unlimited memory access to users of the driver.