Sushi Roll: A CPU research kernel with minimal noise for microarch introspection

https://gamozolabs.github.io/metrology/2019/08/19/sushi_roll.html

by matt_d • 7 years ago

74 13 7 years ago

gamozolabs.github.io

Interesting comment from the author over on reddit[1] discussing using the research kernel to "find 0-day in software and hardware for about 2 years".

[1] https://old.reddit.com/r/programming/comments/csfj53/sushi_r...

ryacko• 7 years ago

https://xenproject.org/2012/06/13/the-intel-sysret-privilege...

I can only speculate as to the types of vulnerabilities not disclosed.

gamozolabs2• 7 years ago

This kernel is just kind of a playground for projects I have. Specifically there were a few from this past year or so.

I used this kernel originally for my vectorized emulator, which is designed as a high-performance fuzzer/harness to find bugs (more info https://gamozolabs.github.io/fuzzing/2018/10/14/vectorized_e...). I used vectorized emulation on Windows DHCP to find multiple RCEs (which were disclosed earlier this year), as well as one of the Intel MDS vulnerabilities (such as RIDL and Fallout) disclosed earlier this year (specifically I found "MLPDS", https://nvd.nist.gov/vuln/detail/CVE-2018-12127).

I do most of my work in a personal kernel as it really gives me an edge with optimization. I'm able to use page tables directly (super fast fork()-like behavior), and write hypervisors that don't have to go through crazy call stacks to vmexit, use bleeding-edge CPU features, etc. Ultimately I just do it because it's fun, but I've found ways to justify it from time to time.

bionsystem• 7 years ago

Is it a pure hobby project on the side, or do you work for a company / research lab ? That is really interesting btw.

bogomipz• 7 years ago

Thanks for posting this. This is a fascinating project and I hope you post more about it. I had a question about something under the Microcode section which stated:

"These are often complex operations, like switching operating modes, reading/writing internal CPU registers, etc."

Is a switch from ring 3 to ring 0 handled by microcode then? If so why is this?

Fnoord• 7 years ago

The exact URL/title was posted one hour earlier. https://news.ycombinator.com/item?id=20743260

dang3• 7 years ago

No, matt_d's was earlier. The IDs tell all: 20736713 < 20743260.

The reason this was confusing is that we put the earlier post in the second-chance queue (described at https://news.ycombinator.com/item?id=11662380), which temporarily modifies the timestamps on re-up as explained here: https://news.ycombinator.com/item?id=19774614. This confusion comes up periodically but I don't know a globally better solution than how we currently do it.

saagarjha2• 7 years ago

Would marking second chance submissions as such help?

Sushi Roll: A CPU research kernel with minimal noise for microarch introspection

Related Stories