5 ms·

> CPU registers leaking information between function calls is still a huge unmitigated issue. How is that a security issue? It's in the same process.

by quacj 9y ago

mikestew 9y ago
A process to which one has invited unvetted visitors ("blindly link in dynamically"). I'm not particularly qualified to agree or disagree, but I think that's where parent is going with this. I'm with you, though, in that I can read the registers from a previous function call, but I'm already in the process so do I even need to work that hard? I eagerly await an answer from those better qualified than I. :-) (And maybe you're that person, quacj, dunno.)
- crb002 9y ago
  Static linking too. Most of us rely on library code maintained by others we trust. Reads from registers that should be empty isn't flagged by most code auditing software.
crb002 9y ago
Say you have a memory pointer to sensitive info in a CPU register. Could the subroutine troll through memory and find it? Yes, but it would be orders of magnitude harder than having that pointer in a register. Better example is if you are using 64 bit ints in registers as security tokens. Those should be zeroed after use and the compiler needs to not accidentally optimize away zeroing them.
- quacj 9y ago
  Do you have a proof of concept you can share for this type of attack? I don't quite see how an attacker would take advantage of this is a real-world scenario.
  - crb002 9y ago
    Yes, John Deere tractor running Windriver Linux; heavy use of dbus and Qt. Any compromised tractor app vendor could inject it. Could probably reproduce from upstream Yocto distro and the free version of Qt. Much larger attack surfaces to worry about like their craptastic security around USBs that farmers stick in to read maps.
- nly 9y ago
  It doesn't matter. If you call a library function you're giving that library license to run arbitrary code in your address space. An RPC is another matter.
- pjc50 9y ago
  It's a subroutine. It has access to the entire program. There is no security boundary there. If you link against code, it's inside your security boundary. This is not something that can be secured.
cryptonector 9y ago
Think of system calls too.
- quacj 9y ago
  Are you referring to callbacks from kernel mode to user mode?

> CPU registers leaking information between function calls is still a huge unmitigated issue. How is that a security issue? It's in the same process.

by quacj 9y ago

> CPU registers leaking information between function calls is still a huge unmitigated issue. How is that a security issue? It's in the same process.

mikestew 9y ago

A process to which one has invited unvetted visitors ("blindly link in dynamically"). I'm not particularly qualified to agree or disagree, but I think that's where parent is going with this. I'm with you, though, in that I can read the registers from a previous function call, but I'm already in the process so do I even need to work that hard? I eagerly await an answer from those better qualified than I. :-) (And maybe you're that person, quacj, dunno.)

crb002 9y ago
Static linking too. Most of us rely on library code maintained by others we trust. Reads from registers that should be empty isn't flagged by most code auditing software.

crb002 9y ago

Say you have a memory pointer to sensitive info in a CPU register. Could the subroutine troll through memory and find it? Yes, but it would be orders of magnitude harder than having that pointer in a register. Better example is if you are using 64 bit ints in registers as security tokens. Those should be zeroed after use and the compiler needs to not accidentally optimize away zeroing them.

quacj 9y ago
Do you have a proof of concept you can share for this type of attack? I don't quite see how an attacker would take advantage of this is a real-world scenario.
- crb002 9y ago
  Yes, John Deere tractor running Windriver Linux; heavy use of dbus and Qt. Any compromised tractor app vendor could inject it. Could probably reproduce from upstream Yocto distro and the free version of Qt. Much larger attack surfaces to worry about like their craptastic security around USBs that farmers stick in to read maps.
nly 9y ago
It doesn't matter. If you call a library function you're giving that library license to run arbitrary code in your address space. An RPC is another matter.
pjc50 9y ago
It's a subroutine. It has access to the entire program. There is no security boundary there. If you link against code, it's inside your security boundary. This is not something that can be secured.

cryptonector 9y ago

Think of system calls too.

quacj 9y ago
Are you referring to callbacks from kernel mode to user mode?