Reading privileged memory with a side-channel

Post by tankenmate » Thu, Jan 04, 2018, 1:02 AM UTC

caf wrote: post #241

comex wrote: post #188

Earlier quoted context omitted.

For variant 1, a kernel JIT is definitely helpful, which is why the Project Zero PoC used it, but it's not required. For variant 2, Project Zero used the eBPF interpreter as a gadget , a fake branch destination, without having to actually create an eBPF program or use the normal userland-facing eBPF APIs at all. And they only chose it as the least "annoying" option (see quote below). edit: I'm not sure how ASID suppo…

To make it a bit clearer how this works: the Variant 2 exploit poisons the branch target buffer to cause the processor's speculative execution in kernel space to jump to an entirely attacker-controlled destination when it hits a branch that matches the information the attacker has placed into the BTB. The actual retired instructions don't go this way of course - the processor detects the misprediction and goes back t…

Post by ebikelaw » Thu, Jan 04, 2018, 1:04 AM UTC

walterbell wrote: post #253

ebikelaw wrote: post #228

Earlier quoted context omitted.

I can't imagine better marketing for cloud services than making it as clear as you can that the world is a very dangerous place for computers and if you don't have a crack team of hundreds of battle-hardened security engineers then you have no business hooking your computers up to the internet.

If true, how are edge computers going to connect to the cloud?

Post by olliej » Thu, Jan 04, 2018, 1:05 AM UTC

jhallenworld wrote: post #248

simion314 wrote: post #201

Earlier quoted context omitted.

From the article it seems that is not 100% sure AMD and ARM are not affected by metldown, only that they could not trigger the issue, but authors mention this "However, for both ARM and AMD, the toy example as described in Section 3 works reliably, indicating that out-of-order execution generally occurs and instructions past illegal memory accesses are also performed."

I would think that any sane implementation would not transmit privileged data to waiting instructions. Look at their Listing 2: Instructions 5 - 7 will be waiting for the privileged data from line 4 (they are not speculatively executed since they have a data dependency on line 4). So why is Intel releasing the privileged data to the waiting instructions? An answer could be that violation checking is delayed until ret…

Post by kibwen » Thu, Jan 04, 2018, 1:05 AM UTC

voidmain wrote: post #267

theptip wrote: post #194

Earlier quoted context omitted.

I think this means we should consider all browser processes to be completely insecure, until mitigations are applied (e.g. Chrome's Site Isolation: https://www.chromium.org/Home/chromium-security/ssca ). Looks like any session token/state could be exfiltrated from your Gmail tab to a malicious JS app running in-process, for example. Am I overreacting here?

It seems like practical attacks rely on having a reasonably precise timer available. The spectre paper uses SharedArrayBuffer to synthesize a timer, which is a recent and obscure feature: https://groups.google.com/a/chromium.org/forum/#!topic/blink... https://groups.google.com/forum/#!topic/mozilla.dev.platform... Chrome and Firefox's "intent to ship" posts both contain claims to the effect that there probably aren't…

Post by cfeeley » Thu, Jan 04, 2018, 1:07 AM UTC