{"id":119185,"date":"2024-08-08T09:43:01","date_gmt":"2024-08-08T07:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie"},"modified":"2024-08-08T09:43:01","modified_gmt":"2024-08-08T07:43:01","slug":"uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-ghostwrite-predostavlyayushhaya-polnyj-dostup-k-fizicheskoj-pamyati-na-cpu-risc-v-xuantie","title":{"rendered":"GhostWrite vulnerability providing full access to physical memory on RISC-V XuanTie CPU","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from the Helmholtz Center for Information Security (CISPA) have published findings on the security vulnerabilities of processors based on the RISC-V architecture, revealing details about a vulnerability code-named GhostWrite. This vulnerability affects RISC-V processors XuanTie C910 produced by the Chinese company T-Head (a subsidiary of Alibaba) and developed in the form of open projects. The vulnerability allows an attacker with limited unprivileged access to the system to read and write to any areas of physical memory and gain access to control peripheral devices such as network cards using MMIO (Memory-Mapped Input\/Output). <\/p>\n
The vulnerability is caused by shortcomings in the processor architecture related to the isolation of additional instructions added by the manufacturer, which expand the RISC-V instruction set architecture and enable direct access to DRAM, bypassing virtual memory mechanisms. The operation of some extended instructions directly with physical memory instead of virtual memory allows for bypassing memory isolation between processes. <\/p>\n
The prepared attack technique is 100% reproducible and requires executing its code within just a few microseconds. Software isolation methods, such as containers and sandbox environments, do not prevent the exploitation of vulnerabilities. The only way to block the vulnerability is by completely disabling support for vector extensions, which leads to a 33% reduction in performance in rvv-bench tests (the report annotation states 77%, while the summary page indicates 33%, with details mentioning a 33% performance drop in memcpy and an 8% drop in memset), and also roughly halves the available set of processor instructions for applications. <\/p>\n