Security Researchers Detail New "BlindSide" Speculative Execution Attack

Security researchers from Amsterdam have publicly detailed "BlindSide" as a new speculative execution attack vector for both Intel and AMD processors.

BlindSide is self-described as being able to "mount BROP-style attacks in the speculative execution domain to repeatedly probe and derandomize the kernel address space, craft arbitrary memory read gadgets, and enable reliable exploitation. This works even in face of strong randomization schemes, e.g., the recent FGKASLR or fine-grained schemes based on execute-only memory, and state-of-the-art mitigations against Spectre and other transient execution attacks."

From a single buffer overflow in the kernel, researchers claim three BlindSide exploits in being able to break KASLR (Kernel Address Space Layout Randomization), break arbitrary randomization schemes, and even break fine-grained randomization.

The researchers were looking at Skylake/Whiskeylake through Coffee Lake plus AMD Zen+ / Zen 2 processors in their research.

Their research paper concludes, "We presented BlindSide, a new exploitation technique that leverages an under-explored property of speculative execution (i.e., crash/execution suppression) to craft speculative probing primitives and lower the bar for software exploitation. We showed our primitives can be used to mount powerful, stealthy BROP-style attacks against the kernel with a single memory corruption vulnerability, without crashes and bypassing strong Spectre/randomization-based mitigations"

More details on BlindSide via VUsec.net. Currently exploring more on this new exploit.