4 ms·
Hector Martin (of the Asahi Linux project) has some nice commentary on it here: https://social.treehouse.systems/@marcan/111655847458820583 https://social.treeh
by jasoneckert 3y ago
Hector Martin (of the Asahi Linux project) has some nice commentary on it here: https://social.treehouse.systems/@marcan/111655847458820583 https://social.treehouse.systems/@marcan/111655847458820583
- dimensi0nal 3y ago[flagged]
- larsnystrom 3y agoSo the problem is unified memory? CPU and GPU uses the same RAM but the GPU doesn’t have proper MMU protections in place, which lets an attacker write to RAM it shouldn’t be allowed to by doing it through the GPU instead of the CPU?
- foobiekr 3y agoGPUs doing DMA is a problem whether you have unified memory or not. This is why IOMMU exists.
- deleted 3y ago[deleted]
- larsnystrom 3y agoBut in more traditional systems the GPU would use its own physical RAM, which should at least make it isolated?
- sudosysgen 3y agoIt still uses DMA for communication with the host, it's just over PCIe instead.
- pseudosavant 3y agoThat thread is a more interesting read than the blog post.
- AceJohnny2 3y ago> There is a vulnerability in the SoCs that I discovered and reported where cache snooping bypasses CTRR at the AMCC level. You can "write" to read only memory ranges and, as long as those writes remain in snoopable cache, they are effective even though AMCC will block them and panic when they are written back. I didn't get any money for that one because the way I exploited it didn't apply to normal macOS (I used it to patch DCP code from m1n1), but now a nation state figured out how to use it for a real exploit chain. "Whoops". Oooff
- darkclouds 3y agoSo it probably also affects Android phones and SBC like RaspberryPi's?
- comex 3y agoThe bypass is Apple-specific… which it must be, because the security feature being bypassed, CTRR, is itself Apple-specific. I don’t think Android phones or Raspberry Pi even have any equivalent.
- ajross 3y agoNo, this is all Apple hardware. Other SOCs often have equivalent features and might plausibly make the same mistake (which per the Hector Martin toot is effectively "the write back cache doesn't check security access control so you can stuff data into it to be snooped by other devices"). But this bug is Apple-only.
- DannyBee 3y agoThis only works at all because there is no IOMMU for the GPU. So they'd also have to decide not to do that as well.
- ajross 3y agoYeah, but lots and lots of hardware lives across a bus without an IOMMU. Until very recently, that was the natural state of things. To me what's notable here is that they have a snoopable cache across a security boundary, where you can get the IO device to read arbitrary data you stuffed in from the CPU, when the CPU can't actually touch the underlying storage being cached!
- kristjansson 3y ago> $150k bounty That’s one heck of a way to fund Asahi
- DannyBee 3y agoRecent XNU in the KDK also have code to do injection of AMCC errors, ECC errors, and DCS errors for testing purposes. I bet someone figured you could do the same for the GPU.