3 ms·
Say you have a memory pointer to sensitive info in a CPU register. Could the subroutine troll through memory and find it? Yes, but it would be orders of magnit
by crb002 9y ago
Say you have a memory pointer to sensitive info in a CPU register.
Could the subroutine troll through memory and find it? Yes, but it would be orders of magnitude harder than having that pointer in a register.
Better example is if you are using 64 bit ints in registers as security tokens. Those should be zeroed after use and the compiler needs to not accidentally optimize away zeroing them.
- quacj 9y agoDo you have a proof of concept you can share for this type of attack? I don't quite see how an attacker would take advantage of this is a real-world scenario.
- crb002 9y agoYes, John Deere tractor running Windriver Linux; heavy use of dbus and Qt. Any compromised tractor app vendor could inject it. Could probably reproduce from upstream Yocto distro and the free version of Qt. Much larger attack surfaces to worry about like their craptastic security around USBs that farmers stick in to read maps.
- nly 9y agoIt doesn't matter. If you call a library function you're giving that library license to run arbitrary code in your address space. An RPC is another matter.
- pjc50 9y agoIt's a subroutine. It has access to the entire program. There is no security boundary there. If you link against code, it's inside your security boundary. This is not something that can be secured.