7 ms·
ELI5, anyone. Are the chip registers not protected? What's the mechanism that's allowing this data sharing to happen?
by alberth 5y ago
ELI5, anyone.
Are the chip registers not protected? What's the mechanism that's allowing this data sharing to happen?
- peteretep 5y ago> So what's the real danger? > If you already have malware on your computer, that malware can communicate with other malware on your computer in an unexpected way. > Chances are it could communicate in plenty of expected ways anyway.
- josephcsible 5y agoThere's two bits of a CPU's register that are shared between all of its processes and that any process can write to. The result is that two sandboxed processes that are supposed to be totally isolated from each other can use this to communicate anyway. One example of how this can be exploited is cross-app tracking: if you told one app your name and another your location, they could secretly communicate with each other so both apps end up with both pieces of information.
- herpderperator 5y agoWhy couldn't a future OS update add access control to these registers?
- josephcsible 5y agoBecause the CPU doesn't provide a practical means to do so.
- herpderperator 5y agoDoesn't the kernel control CPU access?
- kevingadd 5y agoRegisters aren't resources you access through syscalls, there's no way for the kernel to control them unless you're running under virtualization or the CPU architecture specifically allows access control for the register. (As the site notes, virtualization allows controlling access to this register)
- kolbusa 5y agoCan kernel scan each page it maps as executable and return an error if it finds instructions interacting with the 'bad' register? Assuming the kernel requires executable pages to be read-only (W^X), this may even be doable (but probably very very slow).
- josephcsible 5y ago> Assuming the kernel requires executable pages to be read-only (W^X) Which macOS's kernel doesn't.
- marcan_42 5y agoIt does require that, but it allows flipping between RX and RW at will (for JITs), and the M1 actually has proprietary features to allow userspace to do this without involving the kernel, so the kernel couldn't re-scan when those flips happen (plus it would kill performance anyway). Plus, as I said above, this is prone to false positives anyway because the executable section on ARM also includes constant pools.
- josephcsible 5y agoCan't a MAP_JIT region be writable by one thread and executable by a different thread at the same time?
- anyfoo 5y agohttps://developer.apple.com/documentation/apple-silicon/porting-just-in-time-compilers-to-apple-silicon https://developer.apple.com/documentation/apple-silicon/port...
- anyfoo 5y agoBecause the OS has no say. A running program issues an assembly instruction to the CPU to read or write this register, and the CPU complies. For the OS to have a say, the CPU would need to provide a way where the OS tells it (usually by setting certain values in other registers) that the CPU should not allow access, at least under certain circumstances. The article actually does go into certain situations where the access is more restricted (search for "VHE"), but also in how that does not really apply here.
- slver 5y agoYou gotta access those bits though some instructions though. What if the command pipeline filters those instructions.
- deleted 5y ago[deleted]
- anyfoo 5y agoCan you elaborate what you mean? What is the "command pipeline" here?
- x0054 5y agoYou are working here with CPU registers. At this point the OS has no say, it’s a hardware bug. Not a particularly serious one though.
- slver 5y agoI didn't say the OS filters the pipeline. Modern CPUs have a lot of updateable microcode, including how it handles its command pipeline.
- throwaheyy 5y agoModern x86/x64 CPUs. The M1 might not have updatable microcode.
- SilverRed 5y ago>they could secretly communicate with each other so both apps end up with both pieces of information The could also just both ping a server to exchange data.
- Aissen 5y agoOne has access to the internet, the other has not (but has less info).
- acchow 5y agoSounds like this is by design and not really a newly discovered vulnerability. Maybe more of a discovery of deceptive advertising/documentation? Which is to say that Apple's engineers are reading this as non-news.
- BoorishBears 5y agoYour computer might spontaneously combust.
- peter422 5y agoThere is a small bit of memory that all programs on your computer share that isn’t protected in any way. If two misbehaving programs on your computer wanted to communicate in a really really secret way, they could use it. If you don’t have misbehaving programs on your computer that want to secretly communicate than it doesn’t matter.
- deleted 5y ago[deleted]
- phnofive 5y ago> So what's the real danger? > If you already have malware on your computer, that malware can communicate with other malware on your computer in an unexpected way. > Chances are it could communicate in plenty of expected ways anyway.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]