Some of the computer security boffins who revealed last year's data-leaking speculative-execution holes have identified yet another side-channel attack that can bypass security protections in modern systems.
While side channel attacks like Spectre and Meltdown exploited chip design flaws to glean privileged information, this one is hardware agnostic, involves the Windows and Linux operating system page cache, and can be exploited remotely, within limits.
In a paper provided to The Register in advance of distribution early next week through ArXiv, researchers from Graz University of Technology, Boston University, NetApp, CrowdStrike, and Intel – Daniel Gruss, Erik Kraft, Trishita Tiwari, Michael Schwarz, Ari Trachtenberg, Jason Hennessey, Alex Ionescu, and Anders Fogh – describe a way to monitor how certain processes access memory through the operating system page cache.
"We present a set of local attacks that work entirely without any timers, utilizing operating system calls (mincore on Linux and QueryWorkingSetEx on Windows) to elicit page cache information," wrote the researchers. "We also show that page cache metadata can leak to a remote attacker over a network channel, producing a stealthy covert channel between a malicious local sender process and an external attacker."
Related Stories
Google security researchers have come to the conclusion that speculative execution attacks are here to stay without drastic changes to modern CPU architectures, such as removing speculative execution entirely.
Spectre is here to stay: An analysis of side-channels and speculative execution
Related:
Patch for Intel Speculative Execution Vulnerability Could Reduce Performance by 5 to 35% [Update: 2]
Qualcomm Joins Others in Confirming its CPUs Suffer From Spectre, and Other Meltdown News
Congress Questions Chipmakers About Meltdown and Spectre
What Impact Has Meltdown/Spectre Had on YOUR Systems?
Intel Admits a Load of its CPUs Have Spectre V2 Flaw That Can't be Fixed
Intel FPU Speculation Vulnerability Confirmed
New Spectre Variant SpectreRSB Targets Return Stack Buffer
Intel Discloses a Speculative Execution Attack in Software Guard eXtensions (SGX)
Intel 'Gags' Linux Distros From Revealing Performance Hit From Spectre Patches
MIT Researchers Claim to Have a Solution for Some Speculative Execution Attacks
Spectre, Meltdown Researchers Unveil 7 More Speculative Execution Attacks
New Side-Channel Leak: Researchers Attack Operating System Page Caches
(Score: 2) by bob_super on Monday January 07 2019, @06:30PM (6 children)
Must be odd to be a white-hat security researcher : As soon as you show people how good you are at something, they make sure you can't do it again, and you have to find a new flaw to exploit.
The crowning achievement of those guys would be having their skills being completely useless because the world agrees that they were right, and fixes all related issues.
I'm glad for them that pervasive terrible coding is keeping food on their tables.
(Score: 1, Funny) by Anonymous Coward on Monday January 07 2019, @06:40PM (4 children)
No different than fixing up my house. As soon as something goes wrong I take the time to research more-durable / higher-quality repairs so that I won't have to fix x again. Hoping to work myself out of that job while I can still repair my house (eventually will fail due to old age?)
(Score: 3, Funny) by fyngyrz on Monday January 07 2019, @07:12PM (3 children)
Oh, come now. That's just so negative. You could also fail by falling severely ill, getting arrested, or suffering a terrible accident while young!
--
No sense being pessimistic, it wouldn't work anyway.
(Score: 0) by Anonymous Coward on Monday January 07 2019, @07:42PM (2 children)
Thanks for the laugh!
> You could also fail by falling severely ill, getting arrested, or suffering a terrible accident while young!
(Un)fortunately, I've got the genes for a long life (both parents) and I'm well past the adventurous years of youth that might result in arrest or youthful accident.
(Score: 1, Funny) by Anonymous Coward on Tuesday January 08 2019, @05:15AM (1 child)
Meteor strike?
(Score: 0) by Anonymous Coward on Tuesday January 08 2019, @07:06PM
Would you like to do the math?
(Score: 0) by Anonymous Coward on Monday January 07 2019, @09:23PM
Hmm, it is maybe like academia: You build your reputation by getting papers published, then who gives a fuck what happens afterwards.
(Score: 4, Funny) by The Mighty Buzzard on Monday January 07 2019, @09:13PM (2 children)
Fucking tech reporters. I come looking for a remotely exploitable bug and find out they meant remotely exploitable if you've already gained access to run arbitrary code on the box. My fridge is not remotely exploitable if it requires another person or machine inside my house to throw beers from the fridge out the window to the attacker.
My rights don't end where your fear begins.
(Score: 2) by Freeman on Monday January 07 2019, @11:39PM (1 child)
Did you take tips from Tim the Toolman Taylor? 'cause I don't think your Refrigerator is supposed to be throwing things.
Joshua 1:9 "Be strong and of a good courage; be not afraid, neither be thou dismayed: for the Lord thy God is with thee"
(Score: 2) by The Mighty Buzzard on Tuesday January 08 2019, @01:35AM
No, but I'd happily give either Lisa or Heidi a tip of my own.
My rights don't end where your fear begins.