Sandsifter: find undocumented instructions and bugs on x86 CPU

chungy wrote: post #3

badminton1 wrote: post #2

Also from the same author https://sites.google.com/site/xxcantorxdustxx/visual-re

That looks fun, but the site doesn't seem to have any downloads available?

There was a demo around somewhere. Not hard to find.

There is a similar --but less featured-- open source project. https://github.com/wapiflapi/veles

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#5

Post by SAI_Peregrinus » Fri, Jul 28, 2017, 7:24 AM UTC

Christopher Domas does some very cool work. His System Management Mode exploit a few years back was quite nice. It will be interesting to see which processor it is that he found the ring 3 hard lockup instruction in...

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#6

Post by fovc » Fri, Jul 28, 2017, 8:13 AM UTC

Here's a link to the slides [pdf]: https://github.com/xoreaxeaxeax/sandsifter/raw/master/refere...

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#7

Post by _wmd » Fri, Jul 28, 2017, 8:23 AM UTC

tl'dr of the slides:

    Found on one processor... instruction
    Single malformed instruction in ring 3 locks
    Tested on 2 Windows kernels, 3 Linux kernels
    Kernel debugging, serial I/O, interrupt analysis seem to confirm
    Unfortunately, not finished with responsible disclosure
    No details available [yet] on chip, vendor, or instructions

He's found a new f00f bug, winter 2017 is going to be interesting :)

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#8

Post by dtx1 » Fri, Jul 28, 2017, 8:31 AM UTC

This is highly interesting. I assume a lot of those are going to be debug and instructions to help the binning process. Some of these might even unlock access to parts of the CPUs we aren't supposed to have access too, opening the doors to custom microcode (unlikely that anyone outside the CPU OEM can do that though) but may allow us to disable "security features" such as the Management Engine. This is a really interesting approach and i would love to see the results ported to other hardware/vendors. The same could potentially be done with GPUs, ARM-CPUs, etc.

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#9

Post by d33 » Fri, Jul 28, 2017, 8:50 AM UTC

...isn't the usability of the tool limited because it's running in userspace, which has fewer privileges in terms of what instructions can be ran?

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#10

Post by tempay » Fri, Jul 28, 2017, 9:06 AM UTC

_wmd wrote: post #7

tl'dr of the slides: Found on one processor... instruction Single malformed instruction in ring 3 locks Tested on 2 Windows kernels, 3 Linux kernels Kernel debugging, serial I/O, interrupt analysis seem to confirm Unfortunately, not finished with responsible disclosure No details available [yet] on chip, vendor, or instructions He's found a new f00f bug, winter 2017 is going to be interesting :)

For those not aware: https://en.wikipedia.org/wiki/Pentium_F00F_bug

Can these kind of bugs possible to exploit to cause anything more than minor annoyance?