3 ms·
DDRop: Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes
- Retr0id 19d agoI've also been experimenting with interposer-induced dropped writes, but to construct LPE exploits as a means of remote attestation bypass, instead of pwning confidential computing. I've had success against desktop DDR4, but haven't tried DDR5 yet. It should also work for mobile/embedded LPDDR4, LPDDR5, but I've had trouble with my glitches locking up the bus entirely (or something like that, it's hard to diagnose). Some of my notes + PoCs in here: https://github.com/DavidBuchanan314/dram_emfi/tree/main/dropped_writes https://github.com/DavidBuchanan314/dram_emfi/tree/main/drop... (notably a cpython UAF, linux kernel page UAF) (Sorry, there are a lot of AI slop comments in the linux exploit, I didn't get around to cleaning it up)