Millions of GPUs from Apple, AMD and Qualcomm have a serious security flaw — and it could put literally all your data at risk if it isn't fixed

Representational image depecting cybersecurity protection
(Image credit: Shutterstock)

Graphics processing units (GPU) from Apple, Qualcomm, and AMD may be carrying a severe security flaw that allows threat actors to exfiltrate sensitive data from compromised endpoints. 

The threat was revealed by cybersecurity researchers Trail of Bits, who argue that there are millions of devices out there, vulnerable to the flaw they named LeftoverLocals.

With the rising popularity of Artificial Intelligence (AI), cryptocurrency mining, and gaming, GPUs have never been in such high demand. Add supply chain woes, caused by Covid-19, into the mix, and you get manufacturers rushing to increase the supply. However in this hurry, data integrity and security becomes an afterthought, the researchers claim, resulting in LeftoverBits, a flaw that allows hackers to steal anywhere between 5 megabytes and 180 megabytes of data. 

Unpatched devices

“In the CPU world, even a bit is too much to reveal,” Heidy Khlaaf, Trail of Bits’ engineering director for AI and machine learning assurance, told Wired.

Hackers looking to exploit LeftoverLocals first need to obtain access to the target system in some other way. However, they don’t need to have access to the same user account - they can steal data from the GPU belonging to any device user. What’s more, the attack is relatively easy to pull off, Wired suggests, as in the example it showed, the researchers pulled sensitive data using less than 10 lines of malicious code.

Further investigation uncovered GPUs from Apple, AMD, and Qualcomm, all vulnerable to LeftoverLocals, with Nvidia, Intel, and ARM, all dodging the bullet. 

Apple said it addressed the flaw in its latest M3 and A17 processors, which should mean that millions of older iPhones, iPads, and MacBooks, remain vulnerable. MacBooks powered by Apple’s M2 is at risk, the researchers found, but the iPad Air 3rd generation A12 seem to have been fixed. 

Qualcomm said to have released a firmware patch, and urged its users to apply the patch as soon as it’s available. 

AMD said it’s currently working on fixes, which it will offer as “optional mitigations”. These should be released in March this year.

More from TechRadar Pro

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
An abstract image of a lock against a digital background, denoting cybersecurity.
Apple CPU security issue could let hackers steal user data from browsers
Security
Intel slams Nvidia and AMD, claims chip giants have huge numbers of security flaws
Digital image of a lock.
Nvidia systems could be facing another worrying security flaw
AMD logo
Security flaw means AMD Zen CPUs can be "jailbroken"
AMD Ryzen 5 7600X processor
AMD confirms processor security flaws after Asus patch slips out early
AMD logo
AMD patches high severity security flaw affecting Zen chips
Latest in Security
Data Breach
Thousands of healthcare records exposed online, including private patient information
China
Juniper patches security flaws which could have let hackers take over your router
Representational image depecting cybersecurity protection
GitLab has patched a host of worrying security issues
Ai tech, businessman show virtual graphic Global Internet connect Chatgpt Chat with AI, Artificial Intelligence.
AI agents can be hijacked to write and send phishing attacks
China
Volt Typhoon threat group had access to American utility networks for the best part of a year
Abstract image of cyber security in action.
MassJacker malware targets those looking for pirated software
Latest in News
Google Pixel 8a in aloe green showing
Google Pixel 9a benchmark link teases the performance of the upcoming mid-ranger
Quordle on a smartphone held in a hand
Quordle hints and answers for Monday, March 17 (game #1148)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Monday, March 17 (game #379)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Monday, March 17 (game #645)
Apple iPhone 16 Pro HANDS ON
Leaked iPhone 17 dummy units may have given us our best look yet at all four models
A super close up image of the Google Gemini app in the Play Store
It's official: Google Assistant will be retired for phones this year, with Gemini taking over