{"id":46360,"date":"2025-01-08T14:22:48","date_gmt":"2025-01-08T19:22:48","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=46360"},"modified":"2025-01-08T14:23:15","modified_gmt":"2025-01-08T19:23:15","slug":"sysbumps-attack","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2025\/01\/08\/sysbumps-attack\/","title":{"rendered":"SysBumps Attack"},"content":{"rendered":"

Guru Baran<\/a> (via Ric Ford<\/a>, PDF<\/a>):<\/p>\n

\n

The research team from Korea University, led by Hyerean Jang, Taehun Kim, and Youngjoo Shin, presented their findings in a paper titled “SysBumps: Exploiting Speculative Execution in System Calls for Breaking KASLR in macOS for Apple Silicon.”<\/p>\n

Their work represents the first successful KASLR break attack on macOS systems powered by Apple’s custom ARM-based chips.<\/p>\n

[…]<\/p>\n

By exploiting Spectre-type vulnerabilities in certain macOS system calls, the researchers demonstrated that an unprivileged attacker could cause transient memory accesses to kernel addresses, even with kernel isolation enabled.<\/p>\n

A key component of the attack involves using the Translation Lookaside Buffer (TLB) as a side channel to infer information about the kernel’s memory layout. The research team reverse-engineered the TLB structure of various M-series processors, uncovering previously unknown details about its architecture.<\/p>\n<\/blockquote>\n\n

Previously:<\/p>\n