Главная
Study mode:
on
1
Intro
2
CVE-2012-0217 overview
3
Coordinating patches release
4
Known non-affected systems
5
More on Linux case
6
Crash course on ring transitions on x86_64
7
Exception while in ringo
8
More on stack switch mechanism
9
"syscall" instruction
10
"syscall" handler lifecycle
11
Exception in syscall handler...
12
Sysret manual entry, Intel
13
Impact?
14
Exploit techniques
15
What is a non-canonical address?
16
How to force non-canonical address?
17
FreeBSD exploit scenario
18
FreeBSD exploit demo
19
Windows 7 case
20
Windows User Mode Scheduling
21
#GP with usermode RSP
22
Windows 7 exploit
23
Is it reliable?
24
Related research
25
Witchhunt - whose fault is it?.
26
Mitigation?
Description:
Explore a comprehensive analysis of a critical vulnerability affecting multiple operating systems in this Black Hat USA 2012 conference talk. Delve into the intricacies of the "sysret" privileged Intel CPU instruction and its unsafe implementation, which led to user-to-kernel privilege escalation exploits. Gain insights into the technical details of Intel CPU architecture, ring transitions on x86_64, and the stack switch mechanism. Examine specific exploit scenarios for FreeBSD and Windows 7, complete with live demonstrations. Learn about the coordinated patch release process, non-affected systems, and potential mitigation strategies. Understand the far-reaching impact of this vulnerability and the importance of thorough security analysis across different operating systems. Suitable for attendees with a basic understanding of Intel CPU architecture, this talk provides valuable lessons on identifying and addressing widespread security issues in complex systems.

A Stitch in Time Saves Nine - A Case of Multiple Operating System Vulnerability

Black Hat
Add to list
0:00 / 0:00