3 ms·
This is only applicable if you already have root (in order to get beyond that), right? It doesn't expose new risk of local privilege escalation?
by zahlman 2mo ago
This is only applicable if you already have root (in order to get beyond that), right? It doesn't expose new risk of local privilege escalation?
- odo1242 2mo agoYep, I believe so
- ziofill 2mo agoBut it supercharges what can be done once you get root, no?
- odo1242 2mo agoYep.
- UltraSane 2mo agoBy a LOT. It would expose the data Windows keeps isolated using virtualization based security.
- odo1242 2mo agoDoes this mean the exploit can be used in a VM to get access to the host machine?
- smaudet 2mo agoNot necessarily. A VM doesn't have a "real" DMA controller, and this exploit is specific to a family of real hardware CPUs. Its not to say that its not impressive, but its fairly isolated to a specific family of processors from 2013.
- odo1242 2mo agoOh, right. I forgot that DMA controllers are virtualized on VMs.
- MayeulC 2mo agoAFAIK you can't usually replace CPU microcode, as it is signed. Seizing it here, in RW memory, really begs to toy with it: add instructions, edit them. Could you teach your CPU to understand RISC-V? This is just one random idea. But altering PSP code is also interesting, to use it for your own purposes, or extract encryption keys / make it lie to clients (breaking DRM, for instance).
- rep_lodsb 2mo ago>Could you teach your CPU to understand RISC-V? The bulk of microcode is still ROM inside the CPU. Also it's mostly used for the more complex instructions, the basic load/store/add/etc. would be decoded and executed more directly. CPUs have a limited amount of SRAM for holding patches, basically a list of addresses in the microcode ROM, and what their contents should be replaced with. Not enough to totally change the instruction set, but still exciting to potentially get write access to, as indeed the normal update mechanism requires those patches to be cryptographically signed by Intel/AMD.
- nspaced 2mo agoYou can already load your own microcode, and it also works on newer CPUs than the one that the attack described in the OP targets. https://github.com/google/security-research/tree/master/pocs/cpus/entrysign/zentool https://github.com/google/security-research/tree/master/pocs...
- creshal 2mo agoReaching into ring -2 or the TPM allows privilege escalations past traditional "root permissions" and lets attackers defeat the sort of tamper protection that's designed to make escalations to local root manageable. Wipe-resistant malware, falsified cryptographic attestations, all sorts of fun.
- jandrese 2mo agoThis is more about getting at the code that device manufacturers attempt to hide from the end user. Platform keys, secure enclaves, etc...