Re:Keeping Memory Contents Secret
by drewg123 on Monday November 25, 2019 @11:10AM
(#21629424)
It could also just access the physical memory via the direct map (the 1:1 mapping of physical to kernel virtual address space). In fact, this is kind of easier now, since you're guaranteed to find all the interesting stuff in physical memory since MAP_EXCLUSIVE memory cannot be paged out.
[ Parent
| on HN ]
This is why the article says MAP_EXCLUSIVE would exclude the relevant pages from the direct map.
Ugh, I missed that. But there is still nothing preventing a malicious (nvidia) driver from re-adding the pages back. In fact, since they are missing from the direct map, it points anything malicious right at the interesting physical addresses..