A full technical explanation of, and sample code for, the RISC-V CPU-level privilege escalation flaw. This is exploitable in QEMU, and is vulnerable in the current stable implementation spec, though it is in the process of being solved by the RISC-V team:
http://blog.securitymouse.com/2017/04/the-risc-v-files-supervisor-machine.html
Wrote a more elegant for the RISC-V in-silicon System->Machine mode CPU privilege escalation bug.
The exploit allows a System-level kernel to inject an arbitrary payload of executable code into the Machine-level executive.
Full details in a blog tonight, along with sample code! #HITB2017AMS
Boom! Here's proof the current privilege model in #RISC-V is insecure. My malicious kernel breaks out of the Supervisor privilege, infecting highest level privilege (Machine Mode) with illegal instructions, causing panic.
Full details to be released tomorrow at #HITB2017AMS!
Want to break out of the RISC-V QEMU instance? Well, I'm not quite there yet. But... I can get QEMU to forcibly exit emulation without notifying the system. #lame #0day #HITB2017AMS
Welcome to Buildroot
buildroot login: donb
Password:
$ cd /donb
$ ./illegal 0
executing...
MODE, mmu_idx mismatch
x@riscv:/$
donb
HITBSecConf