Bypassing KPTI Using the Speculative Behavior of the SWAPGS Instruction

on YouTube ↗49m

" summary

Claim: SWAPGS executes speculatively and can be abused to swap GS bases during a mispredicted kernel path, letting unprivileged code make the kernel dereference attacker-mapped user addresses and leak pointers via flush+reload. Proof: exploit finds 38 gadgets found in Windows RS5 kernel (triggerable by faults), leaks kernel pointers (<1 ms to trigger, usually <10 tries) and a slower brute-force variant that scans user-space ranges; bypasses KPTI/KVA shadowing. Microsoft issued patches July 2019; Intel has no planned silicon fix.

AI-written summary · about

" chapters (6)

1. 0:00Introduction
2. 3:48Sidechannel Attacks
3. 10:10Segmentation
4. 20:27Research Question
5. 28:01Brute Force Attack
6. 38:36Special Considerations

" related talks

• 41mUsing Microarchitectural Design to Break KASLR and MoreAnders Fogh · RuhrSec 2017
• 43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the ProcessDaniel Gruss, Anders Fogh · Black Hat USA 2016
• 33mExploring a New Class of Kernel Exploit PrimitiveRohit Mothe, Andrew Ruddick · Black Hat Europe 2022
• 14mBranch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by...Kaveh Razavi, Sandro Rüegge, Johannes Wikner · USENIX Security '25
• 13mExploiting Inaccurate Branch History in Side-Channel AttacksAlessandro Biondi, Yuhui Zhu · USENIX Security '25
• 24mCurrent State of Exploit Mitigations in the Linux KernelLucas Amorim · BSides Vancouver 2021
• 48mCapturing 0Day Exploits With Perfectly Placed Hardware TrapsCody Pierce, Matt Spisak, Kenneth Fitch · Black Hat USA 2016
• 36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented ProgrammingSeunghun Han · Black Hat USA 2023