Hacker News new | ask | show | jobs
by lxgr 4105 days ago
This is an issue for any software that is able to access the GPU: http://blog.lxgr.net/tag/opengl.html
3 comments

Yes, that is the exact same issue. While searching for any prior art, i did not find your blog post, but the problem seemed far too obvious for me to be the only one to have ever stumbled upon it. I do think this issue needs some exposure, there seem to be a lot of potential security ramifications.
Just in components that claim to provide security boundaries but then do OpenGL passthrough without precautions. Web browsers handle this this properly in WebGL. VirtualBox is at fault here.

Your linked article is about just running two native desktop apps side by side under the same user account, there isn't any supposed security boundary between them so it's a different case.

Oracle also discourages the use of 3D acceleration for untrusted hosts. See here: http://www.virtualbox.org/manual/ch04.html#guestadd-3d
i have added your blogpost to the document as prior art.