Skip to content

Comment on DEF Con 32 – AMD Sinkclose Universal Ring-2 Privilege Escalation (Not Redacted) [pdf]parent

Comments

Just terminology. Whenever a new higher-privileged entity is created, it is sometimes described as a negative ring.

There was a time when people thought if we could put the secure code in a lower ring, then with it we could protect the rest of the system. With virtualization, the hypervisor is in ring -1, which is technically not a ring, but rather a mode called VMX root operation, post-VMXON. This enables things like the blue pill attack, where the hypervisor is itself presented with a false image of the underlying physical hardware, by a malicious layer. You can find the same pattern in ARM TrustZone, where the secure code is repeatedly broken.

"if only we had ring -N"

Crazy complexity. Mind blown!

It's the same reason that the nominal thrust level on the Space Shuttle Main Engines is 104.5%[1].

No, not 100% (it was originally), 104.5%. Why? Because you don't go back and change all your rules and documentation following subsequent developments in the field, that causes unnecessary confusion and errors down the road.

[1]: https://en.wikipedia.org/wiki/RS-25#Engine_throttle/output

Likewise. Engineers do not idle well.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.