meltdown-exploit | Meltdown Exploit PoC

by paboldin C Version: Current License: No License

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | meltdown-exploit Summary

meltdown-exploit is a C library. meltdown-exploit has no bugs, it has no vulnerabilities and it has medium support. You can download it from GitHub.

Speculative optimizations execute code in a non-secure manner leaving data traces in microarchitecture such as cache. Lipp et. al 2018 published their code 2018-01-09 at Look at their paper for details: Can only dump linux_proc_banner at the moment, since requires accessed memory to be in cache and linux_proc_banner is cached on every read from /proc/version. Might work with prefetch. Works with sched_yield. Build with make, run with ./run.sh. Can't defeat KASLR yet, so you may need to enter your password to find linux_proc_banner in the /proc/kallsyms (or do it manually). Flush+Reload and target array approach taken from spectre paper implemented following clues from Pandora's box is open. Take a look at the full exploit which works with IAIK's version on my machine.

Support

Quality

Security

License

Reuse

Support

meltdown-exploit has a medium active ecosystem.

It has 905 star(s) with 285 fork(s). There are 50 watchers for this library.

It had no major release in the last 6 months.

There are 20 open issues and 35 have been closed. On average issues are closed in 1 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of meltdown-exploit is current.

Quality

meltdown-exploit has no bugs reported.

Security

meltdown-exploit has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

License

meltdown-exploit does not have a standard license declared.

Check the repository for any license declaration and review the terms closely.

Without a license, all rights are reserved, and you cannot use the library in your applications.

Reuse

meltdown-exploit releases are not available. You will need to build from source code and install.

Installation instructions are not available. Examples and code snippets are available.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of meltdown-exploit

Get all kandi verified functions for this library.

meltdown-exploit Key Features

No Key Features are available at this moment for meltdown-exploit.

meltdown-exploit Examples and Code Snippets

No Code Snippets are available at this moment for meltdown-exploit.

Community Discussions

Trending Discussions on meltdown-exploit

How can I find out which cache line is touched by an instruction on an Intel processor?

QUESTION

How can I find out which cache line is touched by an instruction on an Intel processor?

Asked 2018-Jan-05 at 10:46

I read the article about the Meltdown/Spectre exploit that allow reading privileged data from the kernel using hardware bugs in the CPU. It says:

The trick is to line up instructions in a normal user process that cause the processor to speculatively fetch data from protected kernel memory before performing any security checks. The crucial Meltdown-exploiting x86-64 code can be as simple as...
...

ANSWER

Answered 2018-Jan-05 at 10:46

// Further down, there is pseudocode in C# that shows the complete process.

We have a kernel address rcx which is the address of one byte (let's call the value of that byte "X") in kernel memory space that we want to leak. The currently running user process is not allowed to access this address. An exception will be thrown when doing so.

We have the probe array with the size 256 * 4096 bytes in user space which we can freely access. So, this is just some normal array which is exactly 256 pages long. The size of one page is 4096 bytes.

First, a flush operation is executed (First part of "Flush+Reload"). This tells the processor to completely clear the L1 cache. So, no memory page is cached in the L1 cache. (We don't see that in the code in the OP)

Then we execute the code mentioned in the OP.

Source https://stackoverflow.com/questions/48097393

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install meltdown-exploit

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: