4 ms·
Looks like the information was somewhat public available since middle of the last year on https://cyber.wtf/2017/07/28/negative-result-reading-kernel-memory-fro
by j_coder 9y ago
Looks like the information was somewhat public available since middle of the last year on https://cyber.wtf/2017/07/28/negative-result-reading-kernel-memory-from-user-mode/ https://cyber.wtf/2017/07/28/negative-result-reading-kernel-... and http://www.cs.binghamton.edu/%7Edima/micro16.pdf http://www.cs.binghamton.edu/%7Edima/micro16.pdf. Also similar methods from 2013 paper http://www.ieee-security.org/TC/SP2013/papers/4977a191.pdf http://www.ieee-security.org/TC/SP2013/papers/4977a191.pdf (timing side channel attacks).
Any reason for the panic now? Any know malware using it?
- jpatokal 9y agoNo. This was all scheduled to be released on January 9th, but the release was sped up after people started connecting dots. We are posting before an originally coordinated disclosure date of January 9, 2018 because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation. https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...
- j_coder 9y agoI know it was scheduled but the information on the links are public and prior to the scheduled disclosure. A hacker could figure out the problem by reading the available information before the Google Project Zero.
- jakozaur 9y agoJuicy PoC exists?