Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reading privileged memory with a side-channel

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

481–490 of 639 posts

Re: Reading privileged memory with a side-channel

#481

Post by rtpg »

Reading over this.... it sounds like ultimately the exploit in Linux still only works thanks to being able to run stuff in the kernel context through eBPF?

The first section states that even with the branch prediction you still need to be in the same memory context to be able to read other process's memory through this. But eBPF lets you run JIT'd code in the kernel context.

I guess this JITing is also the issue with the web browsers, where you end up getting access to the entire browser process memory.

But ultimately the dangerous code is still code that got a "privilege upgrade"? the packet filter code for eBPF, and the JIT'd JS in the browser exploit?

So if our software _never_ brought user's code into the kernel space, then we would be a bit safer here? For example if eBPF worked in... kernel space, but a different kernel space from the main stuff? And Site Isolation in Chrome?

Re: Reading privileged memory with a side-channel

#482

Post by pastage »

CogitoCogito wrote: post #372
Pyxl101 wrote: post #329

Earlier quoted context omitted.

I browse with NoScript and quite a lot of the web works just fine, in fact. I can selectively enable JavaScript for sites that need it, and that I trust.

Why was this downvoted? This is clearly true. I am in fact doing it right now. I am sitting in an airport and clicked around 20 different comment sections and articles from HN so that I could read them later. None of them gave any issues. The only js that I decided to allow was from HN so that I could expand/hide comments. Does this mean that all websites work? Of course not. But this allows the user to choose which…

Well it's a severe case of confirmation bias. The people I know that uses NoScript like tools white list sites and third parties, that makes it seem like it works better than it really does. Further more they choose not to visit sites that work poorly. All the problems are visible as a new user, sure it's obviously possible to use NoScript but I need to white list too many sites to be able to say it actually works.

Re: Reading privileged memory with a side-channel

#483

Post by pacavaca »

endymi0n wrote: post #433

Hard to find a good spot for this, but: Thanks to anyone involved! From grasping the magnitude of this vulnerability to coordinating it with all major OS vendors, including Open Source ones that do all of their stuff more or less „in the open“, it was almost a miracle that the flaw was leaked „only“ a few days before the embargo - and we‘ll all have patches to protect our infrastructure just in time. Interestingly, i…

Consider how many other of such "gray" patches could already be in the kernel ;)

Re: Reading privileged memory with a side-channel

#484

Post by tankenmate »

caf wrote: post #315
tankenmate wrote: post #271

Earlier quoted context omitted.

But somehow you have to get that kernel address in the first place in order to alias it in the BTB. How do you get that without root?

They test how a series of branches are predicted after returning from a hypercall, which lets them basically dump out the state of the BTB. From that, and knowledge of where the branches are in the hypervisor binary (the binaries themselves aren't really a secret, only the relocated load address is) they can figure out the load address of the hypervisor. See the section "Reading host memory from a KVM guest / Locatin…

But if you use AMD ASID it blocks this as memory mappings for VM guests are in a completely separate address space.

What I was wondering was for local OS user mode to local OS root / kernel mode access; i.e. user to kernel privilege escalation.

Re: Reading privileged memory with a side-channel

#485

Post by gspetr »

CogitoCogito wrote: post #372
Pyxl101 wrote: post #329

Earlier quoted context omitted.

I browse with NoScript and quite a lot of the web works just fine, in fact. I can selectively enable JavaScript for sites that need it, and that I trust.

Why was this downvoted? This is clearly true. I am in fact doing it right now. I am sitting in an airport and clicked around 20 different comment sections and articles from HN so that I could read them later. None of them gave any issues. The only js that I decided to allow was from HN so that I could expand/hide comments. Does this mean that all websites work? Of course not. But this allows the user to choose which…

Some sites like NYT wouldn't even render text (!) for me by default with noscript on.

Then there was that time when I read on HN about Forbes loading 35 MB worth of crap (lots of JS too) when you first access it, sure enough it's completely broken with noscript too if you don't allow it.

Re: Reading privileged memory with a side-channel

#486

Post by consp »

nasredin wrote: post #455
teraflop wrote: post #221

Earlier quoted context omitted.

The Spectre paper includes this line in the acknowledgements: > We would like to thank Intel for their professional handling of this issue through communicating a clear timeline and connecting all involved researchers.

So Google people and the Germans were working on the same thing without knowing of each other until Intel connected them?

Graz is in Austria, but considering these things are usually kept quiet quite long: probably yes

Re: Reading privileged memory with a side-channel

#487

Post by fyi1183 »

londons_explore wrote: post #333
MBCook wrote: post #8

Earlier quoted context omitted.

See the Twitter thread here: https://twitter.com/nicoleperlroth/status/948678006859591682 (Edit: there are 9 posts total, go to her user page to see them all) Seems there are two issues. One, called Meltdown, only effects Intel and is REALLY bad, but the kernel page table changes everyone is making fixes it. The other, dubbed Spectre, is apparently common to the way all processors handle speculative execution and is…

I can't really see how it would be fixable even with new hardware. Speculative execution is fundamental to getting decent performance out of a CPU. Without it you should probably divide your performance expectations by 5 at least. Rolling back all state rather than just user visible state in the CPU is neigh on impossible. When you evict something from the cache, you delete it. Undeleting is hard. There are also a lo…

I agree that we'll probably see new attacks in this area for a long time.

That said, the main new ingredient of Spectre seems to be the idea that userspace can poison the branch target buffer to cause speculative execution of arbitrary code in kernel space. That part of the attack should be fairly easy to mitigate with new hardware, by XORing (or hashing) the index into the BTB with a configurable value that depends on the privilege level. So each process has its own "nonce", and they're all different from the kernel's.

Then BTB poisoning won't work unless the attacker knows its own and the other context's nonce. Even if further attacks are found that leak this nonce, they could be mitigated by changing the nonce at regular intervals.

Re: Reading privileged memory with a side-channel

#488

Post by pit2 »

f2f wrote: post #360
cfeeley wrote: post #279

One of the meltdown paper writers evidently has a sense of humor since "hunter2" [0] is one of the passwords they use in their demonstration [1] [0] http://bash.org/?244321 [1] https://meltdownattack.com/meltdown.pdf (page 13, figure 6)

hunter2 is the industry's accepted PoC password.

wasn't it dolphin?

Re: Reading privileged memory with a side-channel

#489

Post by scarygliders »

kiwijamo wrote: post #449
caf wrote: post #302

Earlier quoted context omitted.

about:config javascript.options.shared_memory in Firefox.

Turned off by default for me in 57.0.3/macOS. Is it usually on by default on other platforms?

Just checked on Windows and it was on by default for me for Firefox 57.0.3
Post reply on HN