If so, why haven't Microsoft and Apple patched it?
The solution is an IO memory management unit with virtualized access to physical memory. I am not sure how you can actually enforce this to devices on the bus though.
So a sane OS should just not allow to initialize a DMA transfer from a newly attached device until a user with enough privilege allows it.
Maybe I'm spoiled by good hardware, but when I wrote FireWire drivers for embedded systems, we didn't just open up DMA access to RAM willy-nilly.
I honestly don't know enough about OHCI to know what the hardware setup is like, but I suspect it's just laziness.
> Attack Mitigation : OSX : Don’t panic – if you are using FileVault2 and OS X Lion (10.7.2) and higher, the OS will automatically turn off DMA when locked – you’re still vulnerable to attacks when unlocked, though
So it sounds like Apple has patched it. You just have to make sure your machine is locked.
http://support.microsoft.com/kb/2516445
It's a well known limitation/tradeoff. Newer machines might ditch DisplayPort for Thunderbolt, which will really suck.
"The drawback of this mitigation is that external storage devices can no longer connect by using the 1394 port, and all PCI Express devices that are connected to the Thunderbolt port will not work. Because USB and eSATA are so prevalent, and because DisplayPort often works even when Thunderbolt is disabled, the adverse effect caused by these mitigations should be limited. "