4 ms·
That link no longer loads for me. AIUI, Spectre can be used to attack the kernel, only if you can get code running in kernel-space, via, e.g. eBPF.
by arohner 9y ago
That link no longer loads for me.
AIUI, Spectre can be used to attack the kernel, only if you can get code running in kernel-space, via, e.g. eBPF.
- contrarian_ 9y agoNo, you could also find a gadget with ROP techniques. The eBPF thing in the paper was purely due to convenience of exploitation.
- bzbarsky 9y ago> That link no longer loads for me. Oh, right, ycombinator's URL parser is broken. I fixed the link to work around the buggy parser....
- elihu 9y agoI think that's almost but not quite exactly right. Spectre variant 2 attacks vulnerable indirect jump code patterns that exist in the kernel (or some other process), but doesn't require running the attacker's code. Spectre variant 1 allows you to infer the contents of memory in the same address space, so that's the one where you'd use eBPF to attack the kernel. Meltdown (variant 3) if I understand correctly can infer memory contents of other address spaces without relying on any assumptions about the code running in the other address space. https://security.googleblog.com/2018/01/more-details-about-mitigations-for-cpu_4.html https://security.googleblog.com/2018/01/more-details-about-m...