Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1736305
| From | Tycho Andersen <tycho@docker.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH v6 03/11] mm, x86: Add support for eXclusive Page Frame Ownership (XPFO) |
| Date | 2017-09-21 03:10 +0200 |
| Message-ID | <urYa5-2kx-3@gated-at.bofh.it> (permalink) |
| References | <un8Wu-3e6-13@gated-at.bofh.it> <un8Wt-3e6-11@gated-at.bofh.it> <urXxo-1QS-15@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Wed, Sep 20, 2017 at 05:28:11PM -0700, Dave Hansen wrote: > At a high level, does this approach keep an attacker from being able to > determine the address of data in the linear map, or does it keep them > from being able to *exploit* it? It keeps them from exploiting it, by faulting when a physmap alias is used. > Can you have a ret2dir attack if the attacker doesn't know the > address, for instance? Yes, through a technique similar to heap spraying. The original paper has a study of this, section 5.2 outlines the attack and 7.2 describes their success rate: http://www.cs.columbia.edu/~vpk/papers/ret2dir.sec14.pdf Tycho
Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread
Re: [PATCH v6 03/11] mm, x86: Add support for eXclusive Page Frame Ownership (XPFO) Dave Hansen <dave.hansen@intel.com> - 2017-09-21 02:30 +0200 Re: [PATCH v6 03/11] mm, x86: Add support for eXclusive Page Frame Ownership (XPFO) Tycho Andersen <tycho@docker.com> - 2017-09-21 03:10 +0200
csiph-web