Comment by jasoneckert
3 years ago
Hector Martin (of the Asahi Linux project) has some nice commentary on it here: https://social.treehouse.systems/@marcan/111655847458820583
3 years ago
Hector Martin (of the Asahi Linux project) has some nice commentary on it here: https://social.treehouse.systems/@marcan/111655847458820583
> There is a vulnerability in the SoCs that I discovered and reported where cache snooping bypasses CTRR at the AMCC level. You can "write" to read only memory ranges and, as long as those writes remain in snoopable cache, they are effective even though AMCC will block them and panic when they are written back. I didn't get any money for that one because the way I exploited it didn't apply to normal macOS (I used it to patch DCP code from m1n1), but now a nation state figured out how to use it for a real exploit chain. "Whoops".
Oooff
Is this like "micro-code patchable" or hard no?
If it's the cache hardware, probably not. That's not programmable, you get whatever configuration the designers baked in, and that's it. Though as described you could likely work around this by changing the cache mode to write-through, albeit at a fairly severe performance penalty for the affected accesses.
2 replies →
So it probably also affects Android phones and SBC like RaspberryPi's?
No, this is all Apple hardware. Other SOCs often have equivalent features and might plausibly make the same mistake (which per the Hector Martin toot is effectively "the write back cache doesn't check security access control so you can stuff data into it to be snooped by other devices"). But this bug is Apple-only.
3 replies →
The bypass is Apple-specific… which it must be, because the security feature being bypassed, CTRR, is itself Apple-specific. I don’t think Android phones or Raspberry Pi even have any equivalent.
So the problem is unified memory? CPU and GPU uses the same RAM but the GPU doesn’t have proper MMU protections in place, which lets an attacker write to RAM it shouldn’t be allowed to by doing it through the GPU instead of the CPU?
GPUs doing DMA is a problem whether you have unified memory or not. This is why IOMMU exists.
But in more traditional systems the GPU would use its own physical RAM, which should at least make it isolated?
1 reply →
That thread is a more interesting read than the blog post.
> $150k bounty
That’s one heck of a way to fund Asahi
Recent XNU in the KDK also have code to do injection of AMCC errors, ECC errors, and DCS errors for testing purposes.
I bet someone figured you could do the same for the GPU.
[flagged]