4 ms·
It seems to me the article is missing one very big piece of information that's mentioned by the linked security research: memory reads/writes in the alternate i
by geofft 5y ago
It seems to me the article is missing one very big piece of information that's mentioned by the linked security research: memory reads/writes in the alternate instruction set are not confined by x86 access protections, but ALTINST can be run by unprivileged code. Is that true? Should the article state it more clearly?
- detaro 5y agoIs "ring 0 but confined by access protections" a thing?
- geofft 5y agoYes: https://en.wikipedia.org/wiki/Supervisor_Mode_Access_Prevention https://en.wikipedia.org/wiki/Supervisor_Mode_Access_Prevent...
- blueflow 5y agoThis is documented on Page A-10 of that processor datasheet: http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemiah%20Datasheet%20R113.pdf http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemia...
- trasz 5y agoWhich states that while the ALTINST instruction is not privileged, it depends on a certain bit in an MSR which needs to be enabled first, and that's privileged.