Qubes uses Xen. Tbh I don't know much about Xen, only KVM.
kCFI is kinda shit compared to PaX RAP.
I don't think you did, but I've seen it before.
RAP is far more performant and more strict.
It's never been too hungry.
It's always been something like 1% performance hit.
LWN debates about grsecurity are not very good because spender is an asshole.
He makes people want to find any reason to hate him, even if he's always right.
He's a brilliant guy though.
And RAP really is remarkable (although it was developed by pipacs who works with him).
They did a prophile on him, yes.
Read that too. Pointer authentication is neat in concept, but it'll take a while to be really solid.
Also I've read issues where it can accidentally allow userspace pointers to point into the kernel or something, don't recall.
Well on ARM it's called PAN not SMAP.
(PAN is like SMAP and PXN is like SMEP)
Also SMAP, unlike SMEP, is necessarily disabled at certain times.
E.g. when doing kernel-to-userspace memory accesses and vice versa.
So SMEP you can just turn on and leave on forever, whereas SMAP you have to turn off when doing copy_to_user() and copy_from_user().
And PaX UDEREF is much better than SMAP anyway. :P
What does KPTI have to do with that?
All it does is unmap the kernel memory in processes until it's needed.
KPTI isn't something that turns off.
It just means the page tables are updated at a context switch. By definition the kernel will be mapped when in kernel mode, but it won't be mapped while in usermode.
It's never accessible from userspace. You'd get a GPF if you tried to access it, KPTI or not.
But KPTI ensures that even though you get a GPF, there won't be any speculative accesses.
And thus no microarchitectural side-channel attacks would be relevant.
I don't think PAC has anything to do with KPTI.
So the attack causes something to point into the kernel.
KPTI can't protect from that.
The one and only thing KPTI can do is prevent speculative accesses of otherwise inaccessible kernel memory.
@J-- I think the "how it's done from userspace" part is left as an exercise for the reader. This is just an exploit primitive, not an exploit chain.
Not really. But persistence is.
Userspace->kernel is not easy, but it's not like Apple is ironclad.
I'd recon Linux with grsecurity would be far more secure in terms of "time taken to get to kernel mode".
@J-- They just throw mitigations out willy-nilly. Some are good, some aren't.
Did you learn more about how KDP worked?
I thought XFG was removed?
Now that they added true forward and backward edge CFI.
Which is pretty much the way RAP works, although I think on Windows it's less fine-grained.
Tbh it is impressive that they're using full CFI.
I wish Linux took that kind of thing seriously.
Their VBS is a good primitive for mitigations.
Even if static KDP is a bad use of it.
That's what the Linux VBH thing is supposed to be like.
At least, if anyone takes it seriously.
All this Windows stuff is going over my head. :P
MS is doing well by adding mitigations and doing lots of static and dynamic analysis, but they still have too much attack surface area, largely due to compatibility issues.
SO.com is not a social site. It is a programming Q&A site. No thanks.
If I wanted to talk to you, you would find a way to contact me in my profile. Many people do include this, if they don't, they don't want to be contacted.
