Stop. Releasing. Attack research. Without. Detection strategies.
Downfall Attacks
11–20 of 349 posts
Re: Downfall Attacks
#12[deleted]
Re: Downfall Attacks
#13Haven't RTFA but would zeroing registers fix this (-mzero-caller-saved-regs=used)?
Re: Downfall Attacks
#14Stop. Releasing. Attack research. Without. Detection strategies.
It was reported to Intel a full year ago, apparently.
Re: Downfall Attacks
#15[deleted]
Re: Downfall Attacks
#16Not again!
Re: Downfall Attacks
#17Earlier quoted context omitted.
If I'm reading this right, the caveat is that the exploit only lets you read registers that have been saved for context-switching. So, in order to extract data, that data must be in constant active use (i.e. loaded in a register) at the time of the attack.
Would environmental variables be something that shows up in context-switching?
[deleted]
Re: Downfall Attacks
#18This is a huge performance hit - up to 50% it is claimed! 70% of modern intel processors are affected apparently as well.
Key context you elided: "This depends on whether Gather is in the critical execution path of a program."
Re: Downfall Attacks
#19Geez! This seems like a _really_ big attack vector. Anyone on the security side have some caveats?
If I'm reading this right, the caveat is that the exploit only lets you read registers that have been saved for context-switching. So, in order to extract data, that data must be in constant active use (i.e. loaded in a register) at the time of the attack.
It claims to also allow you to read any data loaded into a vector register, any data loaded from a {rep mov} (i.e. memcpy), any data used by crypto acceleration, and a bunch more. Basically, the only data it does not let you read is regular loads into the regular GPRs (i.e. what would be a register load in a RISC architecture) though if you save/restore during context switches using the special instructions you will leak the values at the time of the context switch.
This is about as close to a total cross-process data leak as can be imagined.
Re: Downfall Attacks
#20Earlier quoted context omitted.
If I'm reading this right, the caveat is that the exploit only lets you read registers that have been saved for context-switching. So, in order to extract data, that data must be in constant active use (i.e. loaded in a register) at the time of the attack.
Would environmental variables be something that shows up in context-switching?
Typically not, but only because they are not typically accessed frequently.