6 ms·
Your NIC can already access arbitrary RAM via DMA. It can read your keys already.
by jstarks 2y ago
Your NIC can already access arbitrary RAM via DMA. It can read your keys already.
- altairprime 2y agoThat is often incorrect for Apple computers, whether x64+T2 or aarch64: https://support.apple.com/fr-tn/guide/security/seca4960c2b5/web https://support.apple.com/fr-tn/guide/security/seca4960c2b5/... And it’s often incorrect on x64 PCs when IOMMU access is appropriately segmented. See also e.g. Thunderclap: https://www.ndss-symposium.org/wp-content/uploads/ndss2019_05A-1_Markettos_slides.pdf https://www.ndss-symposium.org/wp-content/uploads/ndss2019_0... It may still be true in some cases, but it shouldn’t be taken for granted that it’s always true.
- yencabulator 2y agoNope. https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_ma...
- gmokki 2y agoKernels enable IOMMU of the CPU, which limits the memory areas of the NIC can access to only to the memory it needs to access. This is also why it should be safe to attach pcie over thunderbolt devices. Although I think for Intel CPUs the mmunuded to be disabled for years because their iGPU driver could not work with it. I hope things have improved with the Xe GPUs.