ブックマーク / googleprojectzero.blogspot.com (1)

  • Escaping the Chrome Sandbox with RIDL

    tl;dr: Vulnerabilities that leak cross process memory can be exploited to escape the Chrome sandbox. An attacker is still required to compromise the renderer prior to mounting this attack. To protect against attacks on affected CPUs make sure your microcode is up to date and disable hyper-threading (HT). In my last guest blog post “Trashing the Flow of Data” I described how to exploit a bug in Chr

    Escaping the Chrome Sandbox with RIDL
    jovi0608
    jovi0608 2020/02/18
    すごい。Intel CPUのHyperThreadサイドチャネル攻撃からChromeのIPC情報を盗んでローカルファイルを取ったり実行ファイルを仕込むまで成功している。HT無効化するしかないのか。
  • 1