Intel Responds to Security Research Findings

Re:Intel Responds to Security Research Findings by monocasa on Wednesday January 03, 2018 @05:07PM (#16065729)

If you know the specific kernel being used, all you have to figure out is the base address of the kernel to have to whole layout to break KASLR.

So if it had been a timing attack where an unmapped memory reference takes longer to fail than a memory reference with the wrong permissions, then you could scan all of the KASLR slots without actually reading back any data.

Actually reading data is a waaaaayyy bigger deal.

[ Parent | on HN ]

Re:Intel Responds to Security Research Findings by tptacek on Wednesday January 03, 2018 @05:09PM (#16065742)

Yeah, that's true. I hadn't considered that the fragility of KASLR meant that there are lots of vectors for breaking it that don't require a huge chip break. Sorry, I'm making the thread dumber.

But, I mean: that's what that dude is doing in that tweet, is all I'm saying. :)

[ Parent | on HN ]