Các bài viết liên quan:
A new hardware attack is voiced PACMAN proven against Apple’s M1 processor chipset, capable of equipping a malicious actor with the ability to execute arbitrary code on a macOS system.
MIT researchers Joseph Ravichandran, Weon Taek Na, Jay Lang, and Mengjia Yan say it leverages “speculative execution attacks to bypass a critical memory defense mechanism, ARM Pointer Validation , a security feature used to enforce pointer integrity”.
The researchers added, “while the hardware mechanisms used by PACMAN cannot be patched with software features, memory failures can still occur.”
The vulnerability stems from pointer validation (PAC) code, a line of defense introduced in the arm64e architecture to detect and secure against unwanted changes to pointers – stored objects. store memory addresses – in memory.
PACs aim to solve a common problem in software security, such as a memory security vulnerability, which is often exploited by overwriting control data in memory (i.e. pointers) to convert directs code execution to an arbitrary location controlled by the attacker.
Although strategies such as address space layout randomization (ASLR) have been devised to increase the difficulty of performing buffer overflow attacks, the goal of PAC is to determine the “validity of pointers with minimal size and performance impact”, effectively preventing an adversary from creating pointers for use in an exploit.
This is achieved by protecting a pointer with a cryptographic hash – known as a Pointer Validation Token (PAC) – to ensure its integrity. Apple explains the PAC as follows:
Pointer validation works by providing a special CPU instruction that adds a cryptographic signature – or PAC – to the unused high-order bits of the pointer before storing the pointer. Another instruction clears and validates the signature after re-reading the pointer from memory. Any change to the stored value between write and read will invalidate the signature. The CPU interprets the validation error as memory corruption and places a high-order bit in the pointer, making the pointer invalid and causing an application error.
But PACMAN “removes the main barrier to conducting control-flow hijacking attacks on a protected platform using pointer validation.” It combines memory corruption and speculative execution to circumvent the security feature, leaking “PAC verification results over microarchitecture side channels without causing any problems.”
In short, the attack method makes it possible to distinguish between correct PACs and incorrect hashes, allowing the bad guys to “brute-force the correct PAC value while preventing crashes and building a hijacking attack.” Control-flow control on a PA is enabled by the victim program or the operating system. “
For its part, the crash prevention succeeds because each PAC value is guessed at guessing by time-based sub-channel mining through a translation look-to-side buffer (CTR) using a Prime attack. + Probe.
Speculative execution vulnerabilities, as observed in the Specter and Meltdown cases, weaponize out-of-order execution, a technique used to improve performance in modern microprocessors by how to predict the most likely path of program execution flow.
It is worth noting, however, that the threat model assumes that an exploitable memory corruption vulnerability already exists in the victim program (kernel), thus allowing an attacker to privileged (a malicious application) injects rogue code into certain memory locations in the victim process.
This attack has important implications for designers looking to implement future processors with pointer validation and has broad implications for security, the researchers conclude. confidentiality of future control-flow integrity primitives”.
.
