Exploiting Parallel Memory Write Requests for Covert Channel Attacks in Integrated CPU-GPU Systems

TL;DR

This paper reveals how parallel memory write requests in integrated CPU-GPU systems can be exploited to create covert channels, demonstrating new security vulnerabilities in heterogeneous SoCs with measurable bandwidth and error rates.

Contribution

It uncovers a novel covert channel attack leveraging GPU memory write policies to induce CPU memory stalls in integrated systems.

Findings

Achieved covert channel bandwidths of 1.65 kbps and 4.41 kbps.

Demonstrated the attack's effectiveness with low error rates.

Characterized the impact of GPU write requests on CPU memory performance.

Abstract

In heterogeneous SoCs, accelerators like integrated GPUs (iGPUs) are integrated on the same chip as CPUs, sharing the memory subsystem. In such systems, the massive memory requests from throughput-oriented accelerators significantly interfere with CPU memory requests. In addition to the large performance impact, this interference provides an attacker with a strong leakage vector for covert attacks across the processors, which is hard to achieve across the cores in a multi-core CPU. In this paper, we demonstrate that parallel memory write requests of the iGPU and more specifically, the management policy of the write buffer in the memory controller (MC) can lead to significantly stalling CPU memory read requests in heterogeneous SoCs. We characterize the slowdown on the shared read and write buffers in the memory controller and exploit it to build a cross-processor covert channel in Intel-based integrated CPU-GPU systems. We develop two attack variants that achieve a bandwidth of 1.65 kbps and 4.41 kbps and error rates of 0.49% and 4.32% respectively.