[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20231006221824.GA14376@openwall.com>
Date: Sat, 7 Oct 2023 00:18:24 +0200
From: Solar Designer <solar@...nwall.com>
To: Daniel Weber <daniel.weber@...pa.de>
Cc: oss-security@...ts.openwall.com, fabian.thomas@...pa.de,
lukas.gerlach@...pa.de, ruiyi.zhang@...pa.de,
Michael Schwarz <michael.schwarz@...pa.de>
Subject: Re: Meltdown-US / Meltdown 3a Remaining Leakage
Hello Daniel et al.,
Thank you very much for your research and for posting about it in here!
On Fri, Oct 06, 2023 at 12:07:17PM +0200, Daniel Weber wrote:
> we analyzed the remaining leakage of the "original" Meltdown attack
> (Meltdown-US) (1) and the variant Meltdown 3a (2). We discovered that
> the "original" Meltdown attack can be abused to infer the cache state of
> memory pages that remain mapped despite KPTI. This allows an attacker to
> monitor interrupt activity.
I assume you're talking specifically about Linux's KPTI. Let's be
naming Linux explicitly, as this list isn't only about Linux.
In Linux, /proc/interrupts is generally world-readable. So perhaps
that's something to fix first, since yes it's known to allow for
keystroke timing attacks. Should be fixed in the kernel or/and chmod'ed
by the userland. And then:
> 1) Preventing the Meltdown attack from leaking information about the
> cache state can be achieved by marking the remaining memory pages, e.g.,
> the IDT, as uncacheable. This can be achieved by using a memory-type
> range register (MTRR) or by modifying the corresponding page-table entries.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
