Massachusetts Institute of Technology researchers have identified the TONTOU (Time-of-Neutralization to Time-of-Use) attack technique, offering a new way to exploit microarchitectural vulnerabilities of the Spectre v2 class. This vulnerability allows the determination of kernel memory contents while executing an exploit in user space. The code to block the exploitation of the vulnerability was incorporated into the Linux kernel on August 5 and included in the releases 7.1.7, 6.18.43, 6.12.102, 6.6.149, 6.1.181, 5.15.214, and 5.10.263. <\/p>\n
Researchers demonstrated the possibility for a local unprivileged user to determine the hash of the root user's password stored in the \/etc\/shadow file and loaded into memory during system authentication. They managed to achieve data leakage from kernel memory at a rate of 5.47 bytes per second with an accuracy of 91.97%. Out of 10 test runs of the exploit, averaging 18 minutes, they successfully identified the presence of the \/etc\/shadow file in memory and extracted its contents half the time. <\/p>\n
The exploit was demonstrated on systems with AMD processors and can be applied with AMD CPU families Zen 1-4. The attack is also feasible on Intel systems, but exploitation is more complex. To protect against stack overflow of return addresses and block the SRSO (Speculative Return Stack Overflow) vulnerability, AMD processors use the Safe-RET protection mechanism, which clears the branch prediction buffer after each use and narrows the attack window to 2 instructions executed in a few dozen nanoseconds. <\/p>\n
To bypass this protection and extend the attack window, a CPU throttling technique has been implemented, allowing the interrupt substitution to be executed at the right moment to redirect the execution flow in the kernel and use the interrupt handler to distort the record in the branch prediction buffer. To exploit the SRSO vulnerability, an attacker can create conditions where the prediction block speculatively performs a large number of incorrectly predicted CALL calls, sufficient to overflow the return address stack and overwrite accurately predicted return points located at the beginning of the stack. As a result, the initial stack elements can be overwritten with values chosen by the attacker, which will subsequently lead to the use of these substituted values during the speculative execution of the RET instruction in the context of another process. <\/p>\n
Prosessor, proqnozla\u015fd\u0131rma\u011f\u0131n ba\u015f tutmad\u0131\u011f\u0131n\u0131 m\u00fc\u0259yy\u0259n ed\u0259c\u0259k v\u0259 \u0259m\u0259liyyat\u0131 ilkin v\u0259ziyy\u0259t\u0259 qaytaracaq, lakin spekulyativ i\u015fl\u0259ndikd\u0259 \u0259ld\u0259 edil\u0259n m\u0259lumatlar ke\u015fi v\u0259 mikroarxitektur bufferl\u0259rd\u0259 qalacaq. \u018fg\u0259r s\u0259hv icra edilmi\u015f blok yadda\u015fa m\u00fcraci\u0259t edirs\u0259, onun spekulyativ icras\u0131 \u00fcmumi k\u0259\u015fd\u0259 v\u0259 yadda\u015fdan oxunan m\u0259lumatlarda qal\u0131qlara s\u0259b\u0259b olacaq. Ke\u015fd\u0259n m\u0259lumat \u00e7\u0131xarmaq \u00fc\u00e7\u00fcn ke\u015fi t\u0259hlil ed\u0259r\u0259k ke\u015fdirilmi\u015f v\u0259 qeydi edilmi\u015f m\u0259lumatlara \u00e7\u0131x\u0131\u015f zaman\u0131n\u0131n d\u0259yi\u015fm\u0259sin\u0259 \u0259saslanan bir \u00fcsul t\u0259tbiq oluna bil\u0259r. \n M\u0259nb\u0259: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"