Description
Graphics processing units are the default accelerator for machine learning and highperformance
computing, and their economics push operators to share one device
among mutually distrusting tenants. On the Volta and Turing GPUs that dominate this
hardware there is no hardware-enforced process isolation, so one tenant’s confidentiality
from another rests on the GPU’s kernel driver and the host-side interfaces it exposes.
Most GPU security research places the attacker inside the GPU, measuring side
channels, covert channels, or Rowhammer from a kernel on the device. This thesis
takes the opposite, CPU-initiated position: a host-side process that reads a co-tenant’s
GPU memory through the interfaces it already holds. It runs across two systems, a
containerised consumer GPU and a bare-metal four-GPU server; two adversary tiers,
unprivileged co-tenant and bare-metal root; and the two driver versions (550 and 580)
that bracket NVIDIA’s most recent mitigations.
Most classic residue attacks are closed here: freshly allocated global, unified, and
pinned memory returns no previous owner’s data. The exception is the on-chip shared
memory that a streaming multiprocessor reuses between Multi-Process Service clients.
NVIDIA presents its per-client address space as sufficient for shared hardware, yet
this thesis recovers that residue between clients of the same Linux user and, from it, a
complete AES-128 key and the bit-perfect weights of a neural network. With bare-metal
root, a kernel module and kernel tracing read another user’s video memory and process
buffers, both bypassing userspace-only hardening. A privileged container blocks both,
and is therefore a stronger boundary than bare-metal root itself. The side channels,
cross-GPU experiments, and full driver comparison are developed in the body of the
thesis.
No driver update closes these attacks; the effective defences are deployment choices:
separating tenants by Linux user and running inside a privileged container.
|
Thesis topic in co-operation with the Fraunhofer Institute for Applied and Integrated Security AISEC, Garching