Meltdown Exploit PoC
Speculative optimizations execute code in a non-secure manner leaving data traces in microarchitecture such as cache.
Lipp et. al 2018 published their code 2018-01-09 at https://github.com/IAIK/meltdown. Look at their paper for details: https://meltdownattack.com/meltdown.pdf.
Can only dump linux_proc_banner at the moment, since requires accessed memory
to be in cache and linux_proc_banner is cached on every read from
/proc/version. Might work with prefetch. Works with sched_yield.
Build with make, run with ./run.sh.
Can't defeat KASLR yet, so you may need to enter your password to find
linux_proc_banner in the /proc/kallsyms (or do it manually).
Flush+Reload and target array approach taken from spectre paper https://spectreattack.com/spectre.pdf implemented following clues from https://cyber.wtf/2017/07/28/negative-result-reading-kernel-memory-from-user-mode/.
Pandora's box is open.
Take a look at the full exploit which works with IAIK's version on my machine.
Result:
…The Vulnerable CPU/Kernels list is moved here: https://github.com/paboldin/meltdown-exploit/issues/19
The Invulnerable CPU/Kernels list is moved here: https://github.com/paboldin/meltdown-exploit/issues/22
No open issues yet, or sync has not completed.