TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

The DrK Attack: De-randomizing Kernel ASLR

159 点作者 tsgates超过 8 年前

8 条评论

JoshTriplett超过 8 年前
Providing user control over page faults and using that for a security exploit reminds me of the classic UNIX tale of password checking. A version of UNIX had a privileged mechanism that would check a password (provided by pointer); it did so character-by-character. It also had a way for userspace processes to handle page faults themselves. So, put a password buffer across two pages, with the page boundary after the first character, and change the first character until you get a page fault. Repeat for each character of the password...
评论 #12798319 未加载
评论 #12797550 未加载
评论 #12798298 未加载
ryuuchin超过 8 年前
So yet another KASLR bypass.<p>Reminds me of[1]:<p>&gt; Consider this our &quot;I told you so&quot; that we hope you&#x27;ll remember in the coming years as KASLR is &quot;broken&quot; time and again. Then again, in this offensive-driven industry, that&#x27;s where the money is, isn&#x27;t it?<p>[1] <a href="https:&#x2F;&#x2F;forums.grsecurity.net&#x2F;viewtopic.php?f=7&amp;t=3367&amp;sid=ee9f8c1bacede4863bcab77b96eff623" rel="nofollow">https:&#x2F;&#x2F;forums.grsecurity.net&#x2F;viewtopic.php?f=7&amp;t=3367&amp;sid=e...</a>
评论 #12798351 未加载
评论 #12800106 未加载
评论 #12798474 未加载
josteink超过 8 年前
To me it seems like every time intel tries to create a security safeguard, it almost always without exception ends up being a new attack-vector instead (see &quot;x86 considered harmful&quot;).<p>I&#x27;d love to run simpler versions of the modern intel cpus stripped of all this insecure bloat.<p>Surely I can&#x27;t be the only one?
评论 #12797354 未加载
评论 #12797893 未加载
评论 #12798555 未加载
评论 #12799333 未加载
评论 #12798751 未加载
Cyph0n超过 8 年前
I attended a talk on DrK by Yeongjin a few weeks back at Georgia Tech. Keep up the awesome work guys, and welcome to the front page of HN ;)
willvarfar超过 8 年前
(This popped up on proggit the other day, but got deleted for some reason: <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;58fpi6&#x2F;aslr_protection_on_intel_haswell_takes_only_60ms&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;58fpi6&#x2F;aslr_pr...</a> )
dooglius超过 8 年前
For a system as complex and intricate as a modern processor, it seems impossible to avoid a userspace application from figuring out at least some basic information about the kernel&#x27;s state. It would be better to focus on avoiding actual privilege escalations.
shamsalmon超过 8 年前
I would have loved for this kind of research to be my job. Should have done better in my classes :(
评论 #12797365 未加载
cheiVia0超过 8 年前
Scary :(