Jump-over-ASLR-BTB

分支预测器与 ASLR 作者：Byte Reaper 描述 该仓库包含一个研究性 C 实现，用于演示在地址空间布局随机化（ASLR）背景下与分支预测器、推测执行和基于缓存的侧信道相关的概念。 要求： root@kitploit: Linux x8664 GCC CPU that supports BTB 构建： root@kitploit: gcc btb.c -o BTB ./BTB 快速输出（示例）： root@kitploit: + check System Security for Check branch predictors... + Sleep Success. - Not...

CVE-2023-0045

LinuxにおけるSpectre-BTIユーザ空間緩和策の回避 これは作業中の文書です。誤りや引用漏れがあると思われる場合は、フィードバックをお送りください。 バージョン1.0 José Oliveira esoj Rodrigo Branco BSDaemon はじめに Spectre-BTI攻撃の成功率をテストしていたところ、カーネルAPIを緩和策として使用した際に奇妙なパターンを検出しました1。私たちのテストでは、Linuxカーネルが攻撃を正しく緩和できず、システムコール後も短い期間プロセスが露出したままになることが明らかになりました。...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ibprctlset function updates the Thread Information Flags TIFs for the task and updates the SPECCTRL MSR in the function speculationctrlupdate, but the IBPB is only issued at the next schedul...

microcode_ctl: From CVEorg collector

New Spectre-v2 attack classes have been discovered within CPU architectures that enable self-training exploitation of speculative execution within the same privilege domain. These novel techniques bypass existing hardware and software mitigations, including IBPB, eIBRS, and BHINO, by leveraging...

microcode_ctl: From CVEorg collector

New Spectre-v2 attack classes have been discovered within CPU architectures that enable self-training exploitation of speculative execution within the same privilege domain. These novel techniques bypass existing hardware and software mitigations, including IBPB, eIBRS, and BHINO, by leveraging...

New Intel CPU Vulnerability 'Indirector' Exposes Sensitive Data

Modern CPUs from Intel, including Raptor Lake and Alder Lake, have been found vulnerable to a new side-channel attack that could be exploited to leak sensitive information from the processors. The attack, codenamed Indirector by security researchers Luyi Li, Hosein Yavarzadeh, and Dean Tullsen,...

DEBIAN-CVE-2023-0045

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ibprctlset function updates the Thread Information Flags TIFs for the task and updates the SPECCTRL MSR on the function speculationctrlupdate, but the IBPB is only issued on the next...

Exploit for Externally Controlled Reference to a Resource in Another Sphere in Linux Linux_Kernel

Bypassing Spectre-BTI User Space Mitigations on Linux Th...

F5 Networks BIG-IP : Side-channel processor vulnerabilities (K91229003)

The following three side-channel attacks were publicly disclosed on January 3, 2018 : CVE-2017-5715 Spectre-BTB previously known as Spectre Variant 2 Branch target injection Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosu...

Bypassing ASLR in 60 Milliseconds

Address Space Layout Randomization was a champion hardening technology introduced in most major desktop and mobile operating systems as a mitigation against memory-based code-execution attacks. Bypassing ASLR, however, has become somewhat of a parlor game for attackers and white-hat researchers,...