5 ms·
1. You design your CPU so whenever you execute an add instruction with $r1 = x, $r2 = y (say these are the add inputs), the next add instruction will switch to
by treewash 12y ago
1. You design your CPU so whenever you execute an add instruction with $r1 = x, $r2 = y (say these are the add inputs), the next add instruction will switch to ring-0 mode and run code at address which is the result of the add.
2. You don't need access to the box. You just get the target to load a site with JS that sets x and y to those specfic values and adds them, and then adds zero to some address you want to execute (which you can aim to be shellcode in a JS string or something, but even if not there are a million tricks you can use to execute arbitrary code if you can run code at an arbitrary address).
3. Assuming the JS engine compiles sanely, you now have a way to control any computer and make it do anything via some JS on any web site. Ring-0 can totally bypass all virtualization and even the OS itself.
And this exploit is so simple and powerful that everything else is a waste of time. No need to use statistical and entropy tricks to leak keys. You can own any computer with JS on a web site and steal anything you want from memory, including keys. And you can probably do this without the target noticing anything.
- TheLoneWolfling 12y agoIf you're really being nasty you can potentially do this even without JS - say, by using CSS layout.
- crucini 12y agoBut can one predict how CSS will look to the CPU? Or do you assume a memcpy will happen at some point, and catch it then?
- TheLoneWolfling 12y agomemcpy is one route. But, given that (almost) everyone runs browsers for which the binaries, at least, are avaliable, it's relatively straightforward to come up with something that triggers the vulnerability. And even if you don't know what browser they are using, you can make guesses. For example - if you have an image that's 102px wide and immediately to the right of an image that's 57px wide, at some point the CPU will probably add 57 and 102. Things like that.
- crucini 12y agoSounds convincing. I'm not clear on the "million tricks" though. Suppose you embed some machine language in a string javascript, and use your r1/r2 trick - how can you compute the address of the machine language you want to execute? Or are you saying there are existing chunks of machine language in the OS or apps that would be useful to remote execute, with no arguments?