Yifan Lu writes about hardware and console hacking, including the PS Vita, 3DS crypto, voltage glitching, AES fault attacks and Kindle jailbreaks.
HN commenters link it for the differential fault analysis write-up on attacking hardware AES and for voltage glitching background, though one finds it dense.
I tried reading and gave up at the "Headline"...
Quoting from the bug analysis:
>Headline. The crash is real and reproducible. With musl instrumentation we pin the in-process mechanism precisely: a thread's own store to a freshly- faulted anonymous page becomes invisible to that same thread's reload ~10 instructions later, because the page's backing is replaced mid-function. A pagemap read at the instant of the fault shows the backing is the kernel's zero page. A captured core dump confirms the crash site with matched virtual addresses. The mechanism localizes to the interaction between the per-VMA-lock anonymous-fault fast path and a concurrent munmap's TLB shootdown. A source-level review of Linux 7.0.12 identifies a specific race in that interaction, and a git comparison across v6.19/v7.0/v7.1/mainline identifies the v7.0-introduced change on the munmap-teardown side that widens it.
"a thread's own store to a freshly- faulted anonymous page becomes invisible to that same thread's reload ~10 instructions later, because the page's backing is replaced mid-function."
-> ??? What's a "backing" of a page? Freshly-faulted? Fresh fries?
"~10 instructions later"?
"A pagemap read at the instant of the fault shows the backing is the kernel's zero page."
-> Backing?
"The mechanism localizes to the interaction between the per-VMA-lock anonymous-fault fast path and a concurrent munmap's TLB shootdown."
-> How can a mechanism "localize"?
And more.
This is... words strung…
It's a different exploit. The original exploit is an issue with the Tegra's recovery mode (RCM), requiring a USB payload to be sent to the Switch at boot every time.
I believe the hardmod is a voltage glitching exploit, as described for the Vita here: https://yifan.lu/images/2019/01/Injecting_Software_Vulnerabilities_with_Voltage_Glitching.pdf . It is able to inject code through the onboard memory then load a payload from a memory card rather than USB.
Maybe, or maybe not. Presumably that "more detailed write-up" would be something like the third footnote: https://yifan.lu/2019/02/22/attacking-hardware-aes-with-dfa/. Despite being much more detailed, I still felt just about as dumb! :)
That's covered in the referenced article, https://yifan.lu/2019/02/22/attacking-hardware-aes-with-dfa/, in the `Extracting keys` section
See here: https://yifan.lu/2019/02/22/attacking-hardware-aes-with-dfa/