Rootkit inside GPU Kernel Execution

Ohmin KWON  Hyun KWON  Hyunsoo YOON  

IEICE TRANSACTIONS on Information and Systems   Vol.E102-D   No.11   pp.2261-2264
Publication Date: 2019/11/01
Online ISSN: 1745-1361
DOI: 10.1587/transinf.2019EDL8104
Type of Manuscript: LETTER
Category: Dependable Computing
graphics processing unit,  security,  rootkit,  

Full Text: PDF(446.5KB)>>
Buy this Article

We propose a rootkit installation method inside a GPU kernel execution process which works through GPU context manipulation. In GPU-based applications such as deep learning computations and cryptographic operations, the proposed method uses the feature by which the execution flow of the GPU kernel obeys the GPU context information in GPU memory. The proposed method consists of two key ideas. The first is GPU code manipulation, which is able to hijack the execution flow of the original GPU kernel to execute an injected payload without affecting the original GPU computation result. The second is a self-page-table update execution during which the GPU kernel updates its page table to access any location in system memory. After the installation, the malicious payload is executed only in the GPU kernel, and any no evidence remains in system memory. Thus, it cannot be detected by conventional rootkit detection methods.