Skip to main content

AMD and Apple face a dangerous new security flaw

A preview of the LeftoverLocals vulnerability using llama LLM.
Trail of Bits

Researchers from cybersecurity firm Trail of Bits just found a vulnerability that affects some of the biggest brands in tech, namely Apple, AMD, and Qualcomm. The vulnerability, dubbed LeftoverLocals, affects graphics cards made by those companies. That makes it pretty widespread, with it affecting devices ranging from PCs and servers to tablets and smartphones. This flaw, if exploited, could allow attackers to access and steal data from vulnerable devices.

Normally, when working in a shared environment — such as a workstation or a cloud computing infrastructure — each user only has access to their own data and resources, even when working on the same hardware. However, LeftoverLocals bypasses these security measures and uses GPU memory to let potential attackers steal data from the other users on that same hardware.

Trail of Bits used Llama.cpp, a large language model (LLM), to show how the vulnerability allows an attacker to accurately and swiftly receive data from the system by stealing it from the graphics memory. In this proof of concept, the attacker was able to receive the contents of an LLM query with high accuracy.

It’s hard to say just how widespread this vulnerability is, but Trail of Bits tested 11 GPUs across many different devices. The affected GPUs include AMD’s recently discounted RX 7900 XT, but also graphics in Apple’s MacBook Air (M2) and the 3rd-gen iPad Air based on the A12 chip.

As mentioned, this vulnerability is only said to affect shared devices, so if you’re running a home PC connected to your own personal network, you most likely have nothing to worry about — but cloud computing environments can be affected, too, and that’s where the biggest danger lies for many users.

“An attack program must be co-resident on the same machine and must be “listening” at the same time that the victim is running a sensitive application on the GPU. This could occur in many scenarios: for example, if the attack program is co-resident with the victim on a shared cloud computer with a GPU,” said the researchers in their blog post.

RX 7900 XTX and RX 7900 XT on a pink background.
Jacob Roach / Digital Trends

The researchers have alerted the affected companies, some of which have already responded. It seems that Nvidia, Arm, and Imagination GPUs are not currently affected. Apple appears to have patched the vulnerability on some of its devices, but, as the researchers note, it’s still present on the MacBook Air.

AMD released an update regarding the vulnerability, first shared by Tom’s Hardware, featuring a full list of products that are impacted. It’s one lengthy list, including CPUs going as far back as the Ryzen 3000 and all the way up to AMD’s latest and greatest CPUs, like the Ryzen 7000 series for desktops and the Ryzen 7045 lineup for laptops. GPUs include the RX 5000 series, RX 6000 series, RX 7000 series, and a whole lot of workstation cards, as well as data center graphics. AMD is planning to roll out mitigation options starting in March 2024, but they will not be mandatory and will need to be enabled manually.

LeftoverLocals sounds pretty scary, but fortunately, the impact on home users shouldn’t be massive. Still, if you’re among those who might be affected, it’s a good idea to enable the fix once AMD rolls it out in March. For other vendors, it seems that all we can do is just wait for a patch.

Editors' Recommendations

Monica J. White
Monica is a UK-based freelance writer and self-proclaimed geek. A firm believer in the "PC building is just like expensive…
Your Steam account could be in danger because of this new phishing technique
Steam home screen.

Hackers are once again targeting gamers, and this time around, you could lose your Steam account if you're not careful.

Through the use of the Browser-in-the-Browser technique, hackers have been able to gain access to some high-profile Steam accounts valued as highly as $300,000. Here's how the new hack works and how to make sure you're staying safe.

Read more
Zoom just fixed a major security flaw on Mac. Here’s why you should update now
The Logitech Brio 4K Pro attached to a Macbook.

If you have Zoom installed on your MacBook, you'll want to update the app right now. Zoom spent the weekend patching a major security flaw in its Mac app, and the update is available right now.

According to The Verge, it all began at Def Con, a computer security and hacker conference in Las Vegas. The founder of the security non-profit Objective-See and an ex-NSA security analyst, Patrick Wardle, took to the stage on Friday and presented a stunning find: a massive security vulnerability in the Zoom installer for MacBooks.

Read more
Ransomware gangs are evolving in new and dangerous ways
Silhouette of male hand typing on laptop keyboard at night.

With digital technology growing at a rapid pace, ransomware gangs and their methods continue to advance at an aggressive rate as well.

This observation was detailed by cybersecurity and antivirus giant Kaspersky via a new report, highlighting fresh ransomware trends that have materialized throughout 2022.

Read more