undefined | Better HN

0 pointsnine_k12y ago0 comments

The problem is not in DMA. The problem is that DMA is allowed across memory protection, without authorization and without user consent.

I suppose it made sense when Macs and PCs ran single-user OSes on hardware that lacked memory protection. Keeping the default behavior from that day is not wise for, well, last decade or so. (Fresh OSX seems to have changed accordingly, as the tool's page mentions.)

0 comments

5 comments · 1 top-level

yuliyp12y ago· 4 in thread

You mean the problem with Direct Memory Access is that it's Direct? Memory protection, authorization checks, and user consent are all implemented by the CPU knowing which pieces of memory are what. If you use DMA you're just writing to and reading from specific locations on the RAM chips, irrespective of what the CPU wants you to do. RAM chips don't have ACLs; They'll do whatever requests hit their pins.

Dylan1680712y ago

It's really easy to have direct access to a single range of memory and no access outside of that range. It's also really easy to have somewhat more complicated schemes. There is nothing inherently insecure about DMA. It's just shoddy protocols and/or protocols used in unexpected ways.

reeses12y ago

This is another of those "people did it 100 years ago and now we have to reinvent it" things. The Mark I would never have had this problem.

wmf12y ago

The IOMMU is basically ACLs for RAM, but OSes don't use it as much as they could (possibly because Intel disables it on random SKUs).

beagle312y ago

There's a handshake that's done with the PCIe device; It doesn't cost anything to keep the address/data lines off until the handshake is complete, and require that the user approve the handshake.

True, this will not stop an e.g. accepted external drive from DMAing - but it will stop a randomly plugged thing from doing so.

Not having this level is worse than Windows' of old tendency to autorun anything called "autorun.inf" on a media - because autorun was still subject to user privileges whereas the PCIe "autorun" is not.

j / k navigate · click thread line to collapse