Exploits: BlindSide SpecEx Attacks

[grarpamp]

https://www.vusec.net/projects/blindside/
https://download.vusec.net/papers/blindside_ccs20.pdf
https://www.youtube.com/watch?v=m-FUIZiRN5o

BlindSide allows attackers to “hack blind” in the Spectre era. That
is, given a simple buffer overflow in the kernel and no additional
info leak vulnerability, BlindSide can mount BROP-style attacks in the
speculative execution domain to repeatedly probe and derandomize the
kernel address space, craft arbitrary memory read gadgets, and enable
reliable exploitation. This works even in face of strong randomization
schemes, e.g., the recent FGKASLR or fine-grained schemes based on
execute-only memory, and state-of-the-art mitigations against Spectre
and other transient execution attacks.