3 ms·
From code comments, what I understood (most likely in an incorrect way) is: - Use Metal shader code to make process page table accessible to shaders via page p
by 29athrowaway 3y ago
From code comments, what I understood (most likely in an incorrect way) is:
- Use Metal shader code to make process page table accessible to shaders via page protection layer bug exploited using return oriented programming (ROP)
- Use Metal shader code to acquire read/write access to physical memory
- Use Metal shaders to access the kernel page table
- Deals with ASLR to find the kernel base address
- Obtains process user credentials data structure via the process data structure (from the kernel memory)
- Sets uid and gid to 0 (root) to the user credentials data structure, giving root privileges to the user
- dagmx 3y agoYou’re pretty much correct. GPUs are a very interesting attack vector. Especially as more computation is being pushed to GPUs, and they’re not always well isolated.
- zamalek 3y agoI'm genuinely concerned about the WebGPU attack vector. The possibilities are exciting, but we (everyone) has virtually no experience with securing them (compared to decades of securing x86 - which we still can't pull off). My biggest concern is fingerprinting.
- mmis1000 3y agoFingerprinting is probably inevitable if it is enabled by default. Given game code themselves relies on exact device model to workaround gpu implementation bugs. Gpu compatibility is always a shit show history that relies on all sort of device specific workarounds. You may spoof it. But don't assume it would work perfectly for any moderate to big sized programs.
- dagmx 3y agoI feel like fingerprinting is inevitable with any hardware access, including WebGL or WebGPU. It’s one of my big concerns about Chrome exposing more and more of the hardware it runs on in the goal of being a Web based OS. That said, fingerprinting is not as big a risk as what I was thinking of, which is one process being able to peer into another’s on the GPU. There are various takes on isolation on the GPU but they tend to have strong caveats attached.
- jonhohle 3y agoSomehow I can’t resign myself to this brave new world of web apps with low level hardware access. I do not want web apps doing GPGPU work on my machine. If the browser engine implements high level functionality that way, fine, but I don’t want arbitrary websites using low level hardware directly. They were so preoccupied with whether they could, the never stopped to consider whether they should.
- paulddraper 3y agoIs this substantially different than say, containers with GPU access, right? Lots of computation is moving to GPUs.
- H8crilA 3y agoDo you know what's the original vulnerability that allowed ROP?
- 29athrowaway 3y agohttps://asahilina.net/agx-exploit/#/s_uppl https://asahilina.net/agx-exploit/#/s_uppl Press down to see the slides
- mlindner 3y agoThank you very much for the brief summary versus whatever the thing linked was.
- deleted 3y ago[deleted]