NetSpectre: Read Arbitrary Memory over Network · HackerPapers discussions

NetSpectre: Read Arbitrary Memory over Network — mentioned by monocasa

Thu, 19 Oct 2023 14:53:59 GMT

There's also netspectre which remotely attacks a kernel with malformed network packets. https://arxiv.org/abs/1807.10535

Paper and discussion history. A mention is not an endorsement.

NetSpectre: Read Arbitrary Memory over Network — mentioned by monocasa

Thu, 06 Jun 2019 18:52:39 GMT

> That works, sort of, but how do you even ensure the hardware is actually working? Trust Intel or ARM after what they've shown? Which part are you referring to? > And trying to fully bypass cache and speculation when doing userspace to/from kernel transfers is going to suck. Remapping pages also. Here's a demonstration of doing it remotely, with specially crafted network packets. https://arxiv.org/abs/1807.10535 It's not as hard as you're making it seem, the root here is that hardware is currently broken. > And if MMU is untrustworthy, well... If the MMU is untrustworthy, it doesn't matter…

Paper and discussion history. A mention is not an endorsement.

NetSpectre: Read Arbitrary Memory over Network — mentioned by monocasa

Thu, 06 Jun 2019 15:00:24 GMT

Cache lines aren't cleared on context switches, and there are Spectre variants that are cross address space. There's even a remote Spectre exploit. https://arxiv.org/abs/1807.10535

Paper and discussion history. A mention is not an endorsement.

NetSpectre: Read Arbitrary Memory over Network — mentioned by monocasa

Thu, 06 Jun 2019 14:57:36 GMT

They're just going to have to fix their broken hardware. There are Spectre variants that work cross address space. Hell, there's a Spectre variant that works remotely, with carefully crafted network packets. https://arxiv.org/abs/1807.10535 And don't give me that "oh, we'd have to give up speculation and OoO cores to in order to properly fix Spectre". No, we just need more than two security domains so we can describe to the processor which code should have access to which data. Make Rings 1 & 2 Great Again.

Paper and discussion history. A mention is not an endorsement.