Massachusetts Institute of Technology researchers have identified the TONTOU (Time-of-Neutralization to Time-of-Use) attack technique, offering a new way to exploit microarchitectural vulnerabilities of the Spectre v2 class. This vulnerability allows the determination of kernel memory contents while executing an exploit in user space. The code to block the exploitation of the vulnerability was incorporated into the Linux kernel on August 5 and included in the releases 7.1.7, 6.18.43, 6.12.102, 6.6.149, 6.1.181, 5.15.214, and 5.10.263.
Researchers demonstrated the possibility for a local unprivileged user to determine the hash of the root user's password stored in the /etc/shadow file and loaded into memory during system authentication. They managed to achieve data leakage from kernel memory at a rate of 5.47 bytes per second with an accuracy of 91.97%. Out of 10 test runs of the exploit, averaging 18 minutes, they successfully identified the presence of the /etc/shadow file in memory and extracted its contents half the time.
The exploit was demonstrated on systems with AMD processors and can be applied with AMD CPU families Zen 1-4. The attack is also feasible on Intel systems, but exploitation is more complex. To protect against stack overflow of return addresses and block the SRSO (Speculative Return Stack Overflow) vulnerability, AMD processors use the Safe-RET protection mechanism, which clears the branch prediction buffer after each use and narrows the attack window to 2 instructions executed in a few dozen nanoseconds.
To bypass this protection and extend the attack window, a CPU throttling technique has been implemented, allowing the interrupt substitution to be executed at the right moment to redirect the execution flow in the kernel and use the interrupt handler to distort the record in the branch prediction buffer. To exploit the SRSO vulnerability, an attacker can create conditions where the prediction block speculatively performs a large number of incorrectly predicted CALL calls, sufficient to overflow the return address stack and overwrite accurately predicted return points located at the beginning of the stack. As a result, the initial stack elements can be overwritten with values chosen by the attacker, which will subsequently lead to the use of these substituted values during the speculative execution of the RET instruction in the context of another process.
Prosessor, proqnozlaşdırmağın baş tutmadığını müəyyən edəcək və əməliyyatı ilkin vəziyyətə qaytaracaq, lakin spekulyativ işləndikdə əldə edilən məlumatlar keşi və mikroarxitektur bufferlərdə qalacaq. Əgər səhv icra edilmiş blok yaddaşa müraciət edirsə, onun spekulyativ icrası ümumi kəşdə və yaddaşdan oxunan məlumatlarda qalıqlara səbəb olacaq. Keşdən məlumat çıxarmaq üçün keşi təhlil edərək keşdirilmiş və qeydi edilmiş məlumatlara çıxış zamanının dəyişməsinə əsaslanan bir üsul tətbiq oluna bilər.
Mənbə: opennet.ru
