TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Fallout: Reading Kernel Writes from User Space

98 点作者 lainon将近 6 年前

4 条评论

makomk将近 6 年前
&#x27;Remarkably, the patent explicitly states that: &quot;if there is a hit at operation 302 [partial match using page offsets] and the physical address of the load or the store operations is not valid, the physical address check at operation 310 [full physical address match] may be considered as a hit&quot;&#x27;<p>Wait, Intel thought the insecure optimization which lead to this vulnerability was such a great idea that they <i>actually patented it</i>? Wow.
评论 #20064848 未加载
评论 #20064720 未加载
reubenmorais将近 6 年前
Does anyone know of a list&#x2F;summary of all the different ways OoO can be exploited to create vulnerabilities? It seems there&#x27;s a new attack coming out every month, it&#x27;d be nice to see a list of attacks, affected configurations, and workarounds if they exist.
评论 #20062309 未加载
molyss将近 6 年前
for those who want to know about who&#x27;s impacted :<p>&quot;Intel. We notified Intel about our findings, including a preliminary writeup and proof-of-concept code, on January 31st, 2019. Intel had acknowledged the issue and requested an embargo on the results in this paper, ending May 14th, 2019. Intel has further classified this issue as Microarchitectural Store Buffer Data Sampling (MSBDS), assigning it CVE-2018-12126 and a CVSS ranking of Medium. Finally, Intel had indicated that we are the first academic group to report this issue and that a similar issue was found internally as well.<p>AMD. We also notified AMD’s security response team regarding our findings, including our writeup. AMD had investigated this issue of their architectures and indicated that AMD CPUs are not vulnerable to the attacks described in this paper.<p>ARM. We have also notified ARM’s security response team regarding our findings. ARM had investigated this issue and found that ARM CPUs are not vulnerable to the attacks described in this paper. IBM. Finally, we also notified IBM security about the finding reported in this work. IBM had responded that none of their CPUs is affected, including System-V and PowerPC.&quot;<p>And here&#x27;s a description (from the paper) of the mechanisms :<p>&quot;The Mechanism Behind Fallout. Fallout exploits an optimization that we call Write Transient Forwarding (WTF), which incorrectly passes values from memory writes to subsequent memory reads. In a nutshell, when the program writes a value to memory, the processor needs to first translate the virtual address of the destination to a physical address and then acquire exclusive access to the location. Rather than stalling the store instruction and subsequent computation, the processor records the value and the address in the store buffer, and continues executing the program. The store buffer then resolves the address, acquires the access to the memory location and stores the data.<p>When a value is in the store buffer, care should be taken that subsequent loads from the same address do not read stale values from memory. To solve this, the processor matches the addresses of all load instructions against addresses in the store buffer. In the case of a match, the processor forwards the matching value from the store buffer to the load instruction. To increase efficiency, the processor uses partial address matches to rule out the need for store-to-load forwarding. WTF kicks in when a load instruction partially matches a preceding store and the processor determines that the load is bound to fail. In such cases, instead of cleaning up the state of the processor, it marks the load as faulty, and incorrectly forwards the value of the partially matched store.<p>Exploiting the WTF optimization. Fallout exploits this behavior to leak, through a microarchitectural channel, the value that WTF incorrectly forwards. The attacker deliberately performs a faulty load, causing the CPU to transiently forward an incorrect value from the store buffer. We subsequently leak the value using a Flush+Reload [58] side channel. As the store buffer is a shared resource used by all software running on a CPU core, the incorrectly-forwarded value might not even belong to the attacker’s process.&quot;
评论 #20062109 未加载
评论 #20064091 未加载
musicale将近 6 年前
Shared resources, especially across privilege boundaries, almost always create undesirable side channels that leak information.<p>Hardware designers need to come up with better isolation mechanisms.