Conjuring Hardware Failures for Cross-Ring Privilege Escalation
Christopher Domas demonstrates how software-controlled microarchitectural stresses induce transient hardware faults to achieve cross-ring privilege escalation.
Summary
Pushing Silicon Beyond Specification Limits
Modern x86 microprocessors operate under complex power delivery, thermal management, and clock distribution constraints governed by integrated microcode and firmware.
Software-Induced Microarchitectural Stress
Christopher Domas demonstrates how unprivileged software can execute precise, high-density instruction patterns that generate extreme current draw and localized voltage drops within CPU execution units.
Triggering Predictable Silicon Faults
Inducing transient hardware brownouts causes targeted CPU instruction decoders and privilege check registers to glitch, allowing unprivileged user-space code to break out into kernel and hypervisor execution rings.
Implications for Microprocessor Security Architecture
This research challenges the boundary between hardware and software security, demonstrating that software can directly subvert silicon physical guarantees without specialized physical hardware testbeds.
Related talks
Main Stage·42 min
Philippe Laulheret
Demonstrates the ReVault hardware attack targeting secure microcontrollers embedded across over 100 enterprise laptop models to compromise master keys.
Main Stage·44 min
Enrique Nissim · Krzysztof Okupski
Enrique Nissim and Krzysztof Okupski disclose AMDSinkclose, a vulnerability allowing Ring -2 execution and System Management Mode takeover across millions of AMD processors.
Main Stage·44 min
Enrique Nissim · Krzysztof Okupski
Silicon-level vulnerability in AMD processor System Management Mode enabling persistent Ring-2 privilege escalation invisible to hypervisors.