New "BlindSide" Speculative Execution Attack

[erek]

"From a single buffer overflow in the kernel, researchers claim three BlindSide exploits in being able to break KASLR (Kernel Address Space Layout Randomization), break arbitrary randomization schemes, and even break fine-grained randomization.

The researchers were looking at Skylake/Whiskeylake through Coffee Lake plus AMD Zen+ / Zen 2 processors in their research.

Their research paper concludes, "We presented BlindSide, a new exploitation technique that leverages an under-explored property of speculative execution (i.e., crash/execution suppression) to craft speculative probing primitives and lower the bar for software exploitation. We showed our primitives can be used to mount powerful, stealthy BROP-style attacks against the kernel with a single memory corruption vulnerability, without crashes and bypassing strong Spectre/randomization-based mitigations""

https://www.phoronix.com/scan.php?page=news_item&px=BlindSide

 

[Ready4Dis]

Honestly, this is turning into the boy that cried wolf... I don't think anyone even cares about more speculative execution threats anymore. It's like, if you tweak an existing one slightly, boom, you have another. I guess this ones interesting because it is used against random layouts?

 

[erek]

Honestly, this is turning into the boy that cried wolf... I don't think anyone even cares about more speculative execution threats anymore. It's like, if you tweak an existing one slightly, boom, you have another. I guess this ones interesting because it is used against random layouts?

 

[bigddybn]

I didn't read the article but is this another "you need physical access to the machine which means you're screwed anyway" exploits?

 

[Lakados]

I've generally found that with an appropriate firewall and a very defined rule-set on said firewall to severely limit access these kinds of exploits are negated there, and a 0 tolerance policy on VPN's helps a lot.

 

[Ready4Dis]

I didn't read the article but is this another "you need physical access to the machine which means you're screwed anyway" exploits?

This is a you need a buffer overrun in order to execute code in order to perform a speculation attack. So, no physical access on this one, but it does require a compromised system in some manner. It's not just like you can run code in javascript on a browser and do it.