Escaping the Chrome Sandbox with RIDL

tl;dr: Vulnerabilities that leak cross process memory can be exploited to escape the Chrome sandbox. An attacker is still required to compromise the renderer prior to mounting this attack. To protect against attacks on affected CPUs make sure your microcode is up to date and disable hyper-threading (HT). In my last guest blog post “Trashing the Flow of Data” I described how to exploit a bug in Chr

[jovi0608]

すごい。Intel CPUのHyperThreadサイドチャネル攻撃からChromeのIPC情報を盗んでローカルファイルを取ったり実行ファイルを仕込むまで成功している。HT無効化するしかないのか。