Comment by quotemstr
3 hours ago
Even physical DRAM access would be thwarted by transparent total memory encryption, so this hack is still something else.
3 hours ago
Even physical DRAM access would be thwarted by transparent total memory encryption, so this hack is still something else.
It's not fully mitigated by encryption, you can still do a lot of damage without being able to observe plaintexts. For example, you could "rewind" a ciphertext block to an earlier value, and induce a UAF-like condition in the software it belongs to.
Apple’s Secure Enclave has replay protection since Apple A11.
Generally, I don’t see why a modern security platform wouldn’t have its own private SRAM to be used as a root of trust for encrypted blobs stored in shared DRAM.
Right, that is in addition to mere encryption.