4 ms·
So how does a bug in the CPU cache controller cause a remote execution exploit? You can write an exploit into memory, have it cached somehow, trigger the bug,
by chubot 14y ago
So how does a bug in the CPU cache controller cause a remote execution exploit? You can write an exploit into memory, have it cached somehow, trigger the bug, and then the CPU will execute the wrong data in the CPU cache?
- fleitz 14y agoA cache bug allows you to overwrite effectively any area in memory, including in this case kernel memory. Since you can overwrite kernel memory all you need to do is change the uid of your process to 0, and then the OS will happily do whatever you want. Alternatively just overwrite the address of a popular system call to a function that you prefer. With a little metasploit code this thing should be completely cross platform.