7 ms·
But somehow you have to get that kernel address in the first place in order to alias it in the BTB. How do you get that without root?
by tankenmate 9y ago
But somehow you have to get that kernel address in the first place in order to alias it in the BTB. How do you get that without root?
- aidenn0 9y agoYou boot up your own copy of Ubuntu LTS-whatever and read the address of it as root. KASLR is not enabled everywhere, and where it is, there are other attacks to defeat it, which are mentioned in the paper.
- caf 9y agoThey test how a series of branches are predicted after returning from a hypercall, which lets them basically dump out the state of the BTB. From that, and knowledge of where the branches are in the hypervisor binary (the binaries themselves aren't really a secret, only the relocated load address is) they can figure out the load address of the hypervisor. See the section "Reading host memory from a KVM guest / Locating the host kernel". It's terribly clever.
- tankenmate 9y agoBut if you use AMD ASID it blocks this as memory mappings for VM guests are in a completely separate address space. What I was wondering was for local OS user mode to local OS root / kernel mode access; i.e. user to kernel privilege escalation.
- caf 9y agoIt isn't obvious at all how a separate address space would block that method. What would block it is flushing the branch predictor state when switching privilege levels and/or address spaces.
- deleted 9y ago[deleted]
- loulan 9y agoI've tried reading it and I still find all of this very confusing. Could you ELI5?
- deleted 9y ago[deleted]