Winter is Coming Back
summary
Claims a reproducible exploit that defeats CAT-style physical isolation and gains root and kernel privileges by combining memory allocator grooming, mmap-driven placement of kernel-owned but user-mapped buffers, and an efficient single-sided rowhammer guided by a row-conflict timing channel (92%/97% latency separation). The pipeline: locate kernel-owned mmapped regions, exhaust small blocks to force page tables into target blocks, hammer adjacent rows, detect an exploitable page table and overwrite credential fields; demo finds a hit after ~39 hammer rounds.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:27Memory Access
- 7:29Raw Ham Attack
- 11:17Performance Counter
- 14:15Key Steps
- 16:40Tab Ownership
- 19:00Summary
- 27:38Verification
- 28:32Privilege Escalation
- 32:41Exploitable Buffer
- 33:11Medication
- 33:37Limitations
- 34:43Recap
- 35:23Questions
related talks
29mCAn’t Touch This...
40mRowhammer Attacks: A Walkthrough Guide
28mFlip Feng Shui: Hammering a Needle in the Software Stack
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
51mExploiting Hardware Glitches And Side Channels In Perfect Software
41mUsing Microarchitectural Design to Break KASLR and More
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
33mExploring a New Class of Kernel Exploit Primitive