Preventing DMA Attacks from Thunderbolt Devices
summary
Shows that Thunderbolt peripherals can still bypass DMA remapping and gain PCIe access to system memory on unpatched Linux setups despite vendor mitigations. Presents root-cause analysis of Linux driver and kernel gaps, a proof‑of‑concept malicious device that reads kernel memory, and concrete countermeasures: IOMMU enforcement, kernel configuration hardening and kernel patches tested to block the attack on current distributions. Demonstrations succeed on vulnerable machines and fail after the fixes.
AI-written summary · about
chapters (7)
- 0:00Start
- 18:16Case Description
- 22:15Host Machine - Hung task Backtrace
- 29:36KSM merge list extraction
- 30:30Introduction to the KSM Stable Tree (Stable/Unstable tree)
- 32:13Automatic NUMA balancing
- 34:34FlaneGraph of the performance problem
related talks
34mPreventing DMA Attacks from Thunderbolt Devices
27mProtecting Data In-Use from Firmware and Physical Attacks
39mTaming DMA: Tales Wrestling Memory Corruption
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
19mKeynote: MDS, Fallout, Zombieland & Linux
20mKeynote: MDS, Fallout, Zombieland & Linux
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process- 39mTaming DMA: Tales Wrestling Memory Corruption