tl'dr of the slides: Found on one processor... instruction Single malformed instruction in ring 3 locks Tested on 2 Windows kernels, 3 Linux kernels Kernel debugging, serial I/O, interrupt analysis seem to confirm Unfortunately, not finished with responsible disclosure No details available [yet] on chip, vendor, or instructions He's found a new f00f bug, winter 2017 is going to be interesting :)
For those not aware: https://en.wikipedia.org/wiki/Pentium_F00F_bug Can these kind of bugs possible to exploit to cause anything more than minor annoyance?
Sandsifter: find undocumented instructions and bugs on x86 CPU
21–30 of 94 posts
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#22Also from the same author https://sites.google.com/site/xxcantorxdustxx/visual-re
That looks fun, but the site doesn't seem to have any downloads available?
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#23Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#24This is great. That a program can learn about and exploit the CPU on which it is running from unprivileged userspace reminds me of the notion in Charlie Stross' Accelerando of running a timing attack against the universe to learn about the virtual machine in which we are being simulated.
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#25...isn't the usability of the tool limited because it's running in userspace, which has fewer privileges in terms of what instructions can be ran?
I was wondering this myself until I read the pdf: > For effective results, the injector should be able to identify instructions in more privileged rings, even if it cannot actually execute those instructions. >This approach allows the injector to detect even privileged instructions: whereas a non-existing instruction will throw a #UD exception, a privileged instruction will throw a #GP exception if the executing proc…
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#26Earlier quoted context omitted.
Makes sense. I was thinking if there could be a bootable fuzzer of this kind, but you're right that it would be very difficult for it to be both usable and not crash very quickly.
I think once you found all possible instructions it shouldn't be too hard (for someone much smarter then me) to essentially generate a minimal OS that systematically tries out all found instructions from ring 0. That should dramatically reduce the amount of reboots necessary to actually try them all out compared to bruteforcing them from ring 3
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#27No instructions there to disable the IME?
That's a mostly unused namespace of 2^32 64bit registers. To hide things even better, it would also be possible to change behavior based on officially unrelated registers (eg. MSR $x only acts as IME-switch if the calling address also ends in $y and esi is $z)
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#28...isn't the usability of the tool limited because it's running in userspace, which has fewer privileges in terms of what instructions can be ran?
I was wondering this myself until I read the pdf: > For effective results, the injector should be able to identify instructions in more privileged rings, even if it cannot actually execute those instructions. >This approach allows the injector to detect even privileged instructions: whereas a non-existing instruction will throw a #UD exception, a privileged instruction will throw a #GP exception if the executing proc…
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#29Earlier quoted context omitted.
I think once you found all possible instructions it shouldn't be too hard (for someone much smarter then me) to essentially generate a minimal OS that systematically tries out all found instructions from ring 0. That should dramatically reduce the amount of reboots necessary to actually try them all out compared to bruteforcing them from ring 3
What about hangs? I think you'd need a watchdog in order to have the process automated.
Re: Sandsifter: find undocumented instructions and bugs on x86 CPU
#30This is great. That a program can learn about and exploit the CPU on which it is running from unprivileged userspace reminds me of the notion in Charlie Stross' Accelerando of running a timing attack against the universe to learn about the virtual machine in which we are being simulated.
It would be even better if there was a web service that would collect these logs for different processors so everyone didn't have to invest the time to run the analysis.
The results of a scan can sometimes be difficult for the tools to automatically classify, and may require manual analysis. For help analyzing your results, feel free to send the ./data/log file to xoreaxeaxeax@gmail.com. No personal information, other than the processor make, model, and revision (from /proc/cpuinfo) are included in this log.