IBM and VU Amsterdam University researchers published on March 12th their study about the new GhostRace attack type.
Apart from the technical paper, blog post and Proof of Concept exploit, they also released scripts for scanning the Linux kernel for SCUAF gadgets.
GhostRace exploits Speculative Race Conditions and is tracked as CVE-2024-2193.
All major hardware makers, like Intel, AMD, ARM, and IBM. operating systems and other software that uses conditional branches to determine whether to enter critical regions.
An SRC attack can grant hackers to access sensitive information from memory, like passwords and encryption keys.
Exploiting CVE-2024-2193 is not an easy way to breach a system.
It requires either physical access to the targeted device or obtaining privileged access.
All the common synchronization primitives implemented using conditional branches can be microarchitecturally bypassed on speculative paths using a Spectre-v1 attack, turning all architecturally race-free critical regions into Speculative Race Conditions, allowing attackers to leak information from the target software.
Race conditions appear if several threads try to access a shared resource at once.
To avoid race conditions, OSes use synchronization primitives.
Security analysis revealed that a malicious actor could use race conditions along with speculative execution, largely used technique for CPU attacks.
A proof of concept showing step-by-step how the SRC concept works is available on GitHub, here.
A generic SRC mitigation to serialize all the affected synchronization primitives on Linux.
Our mitigation requires minimal kernel changes and incurs only ≈5% geomean performance overhead on LMBench.
Researchers notified the major hardware vendors and the Linux kernel regarding their findings about Speculative Race Conditions at the end of 2023.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, and Youtube, for more cybersecurity news and topics.
If you liked this post, you will enjoy our newsletter.
Get cybersecurity updates you'll actually want to read directly in your inbox.
Livia Gyongyoși is a Communications and PR Officer within Heimdal®, passionate about cybersecurity.
This Cyber News was published on heimdalsecurity.com. Publication date: Wed, 13 Mar 2024 18:13:05 +0000