@ezhes_

"if i had a nickel for every time i accidentally found a zero click RCE, i'd have two nickels, which isn't a lot but it's weird that it happened twice" she/her

 Berkeley, CA
ezh.es
Joined April 2020
  • Tweets271
  • Following93
  • Followers1.5K
5Media
Replying to @ImogenBits
if i take your hand and you take mine, we'll both be locked together till the all mighty kernel above decides to strike us both down 💞
6
If you are interested in uArch Security, we just opened an internship position at @Apple! The position is focused on offensive research, and you will be contributing to the security of some of our most advanced CPUs in one of the coolest teams. Apply at: jobs.apple.com/en-us/details…
4
26
104
20,319
First big result from our new CPU research project, a use-after-free in AMD Zen2 processors! 🔥 AMD have just released updated microcode for affected systems, please update! lock.cmpxchg8b.com/zenbleed.…
34
649
62
1,744
339,433
MD5 (absolutely_not_a_ppl_bypass.txt) = a332a9a9c87136ec1615b9af701c171a
2
25
it's incredible what sorts of bugs you can find while procrastinating on studying for finals lol. coming soon to a product-security@ near you :)
1
6
Little late on reading this paper, but throughly enjoyed it :) tldr: some CPUs use the BHB to index the BTB to improve accuracy. If you massage the BHB, you can hit any other same context entry in the BTB to cause a misprediction to your choice of preexisting target. /1
VUSec@vu5ec8 Mar 2022
Spectre-v2 is back! Disclosing Branch History Injection (#BHI/#Spectre-BHB), bypassing Spectre-v2 hw defenses to leak arbitrary kernel/host memory (e.g., root password hash below). Joint work by @enrico_barberis @pit_frg @nSinusR @herbertbos @c_giuffrida: vusec.net/projects/bhi-spect…
1
1
1
17
It's neat seeing how even the smallest user taint of predictor structures can come back to bite you. I also really appreciated the discussion on exploitability when eBPF is unavailable—too many papers take unprivileged access to a kernel JIT for granted when it is rare indeed /2
1
3
I am somewhat curious why AMD and some of Arm's cores didn't see similar issues; using BHBs to make BTB entries context sensitive seems like a natural choice (ie a previous type check correlated with the indirect target). Maybe it's not as helpful as I imagine? Too expensive? 3/3
2
guess who has two thumbs, a kernel fuzzer, and a MacBook that no longer boots? it's me!! at least the screen did a cool thing before it completely conked out 😭🤡
4
2
74
I don't know what I hit but it hangs on boot with no signs of life. Guess it's DFU time, never fuzzing my personal hardware ever again lol
1
7
Allison Husain {@[email protected]} retweeted
Bill@btw32673 May 2022
Replying to @SCOTUSblog
The justices now can join the citizens in not trusting the Court.
11
94
3
2,357
free awful idea: are you worried about other CPUs/bus agents in your system scribbling on your code and hijacking your kernel? simple! fault your code into the L1I$ and then turn off CPUECTLR_EL1.SMPEN to make your core fully incoherent/ignore cross-core cache ops 🥲
2
3
18
and, jokes aside, this is super cool because you can use this to build an OS on commodity hardware that is resistant against an adversary with full physical memory R/W (assuming they compromise after your core booted) since you can authenticate any data you load/store from RAM
1
12
there are also some fun small hacks you can make for specific cores like the A53 where SMPEN also makes the L1D$ incoherent and so you can just treat the D$ as secure data memory. The A53 has a pLRU policy for L1$s so you don't even have to do anything evil to make it work :)
1
7
Replying to @ezhes_ @iBSparkes @Gok @pedantcoder
I think whatever slight difference that has is largely irrelevant since while the 4% CPU performance gap is acceptable, the 25% memory burden is not. They also ran tests in C using real PAC instructions so it seems like they at least did their due diligence here
3
2
(it's not 3 actually, misread the table. It looks like 6 integer FUs are available to xor, which might be an actual problem for their methodology given the sheer size of the reorder buffer)
1
me: hey xcodebuild, can u compile this project for me please? xcodebuild: best I can do is heap corruption and crash me: understandable have a nice day
xcodebuild: malloc: Heap corruption detected, *** Incorrect guard value: 105553180400000

ALT xcodebuild: malloc: Heap corruption detected, *** Incorrect guard value: 105553180400000

3
44
Today we present deep research from our @wipawel into the branch predictor of AMD CPUs and abusing its behavior to exploit Spectre v1 much more easily than previously understood, culminating in reproducing an arbitrary kernel mem leak PoC in only 3 days. grsecurity.net/amd_branch_mi…
5
79
8
206
ARM friends: does anyone know what SCTLR.UMA is actually useful for? It lets EL0 control interrupt masking, which seems like a universally unwise thing since then user space could just turn off interrupts and hog a core forever. Is this a hack for RTOSs? who wanted this so bad??
1
4
I'm using it to do micro user space context switches but I cannot for the life of me figure out why this feature exists in the first place since it clearly wasn't meant to do this lol
Allison Husain {@[email protected]}@ezhes_29 Dec 2021
Replying to @ezhes_
I don't know what you'll do with this information, but I'm using it to build a terrifying toy OS which shares one page table between all processes and just protects the other process' memory on ctx switch instead of switching tables. It actually works but it feels 100% illegal.
3
just accidentally broke my personal record of most ":)" in a short email. who knows, maybe that third smiley was the really important one which correctly conveys that i didn't mean to be confrontational 🙃
5
Load more