[若渴計畫] Studying ASLR^cache
•Download as PPTX, PDF•
1 like•430 views
Timing side-channel attack一類，目標是MMU的cache，透過攻擊者精巧的記憶體安排使得victim的TLB產生miss，並觀察且推得victim正在使用的memory address。
Recommended
More Related Content
What's hot
What's hot (20)
Similar to [若渴計畫] Studying ASLR^cache
Similar to [若渴計畫] Studying ASLR^cache (20)
More from Aj MaChInE
More from Aj MaChInE (18)
Recently uploaded
Recently uploaded (20)
[若渴計畫] Studying ASLR^cache
- 2. Purposes of Page table and Physical Tag virtual memory physical memory cache page table physical tag data/instructions data/instructions
- 3. Page Tables with MMU’s PT Walker • Page tables point to the next step in a tree 0x644b321f4000 11001000100101100110010000111110100000000000000 offset
- 4. PTs with Security-sensitive Secrets Encoded
- 5. A 32KB 4-way Set-associative Data Cache with Physical Tag http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.den0024a/ch11s01s02.html Physical way?? byte offset * cache line(cache set)會表示 1~ n page entry, for example: 8 PE = a cache line on x86_64. 1 PE = 8 bytes * x86_64中，6bit表示cache set ，3ibt表示cache entry
- 6. A 2-way Set-associative Cache http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.den0024a/ch11s01s02.html 0X000.0000的資料可能在way 0 或 way1
- 7. The Same Cache Set in Different Pages https://arxiv.org/pdf/1702.07521.pdf set field 一樣 Attacker Victim
- 8. p.29 https://www.vusec.net/wp-content/uploads/2016/11/TalkGras.pdf * 10 sets per 1 way • 1,2,3,4,5 表示 cache line offset • colors 意思是 不同的page的某相同offset的PT entry 在同一個cache set，則 此不同page的其某相同offset的PT entry也會在某一個相同的cache set
- 9. Caches • D, I and Unified TLB (Page table cache) • D, I and Unified cache • L3/ Last-level Cache (LLC)
- 10. Virtually Indexed, Physically Tagged Caches https://www.youtube.com/watch?v=IhIyPq7VCek * 重點行為Flush TLB
- 11. High Level Overview of the AnC Attack • By executing specially crafted memory access patterns on a commodity Intel processor, we are able to infer which cache sets have been accessed after a targeted MMU PT walk when dereferencing a data pointer or executing a piece of code. As only certain addresses map to a specific cache set, knowing the cache sets allows us to identify the offsets of the target PT entries at each PT level, hence derandomizing ASLR. http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf
- 12. Intel i7 Memory Hierarchy plus Clock Latency for the Relevant Stages http://www.ieee-security.org/TC/SP2013/papers/4977a191.pdf * 因為MMU/ Cache 只有一個，所以可由很多process共用 page table
- 13. P.4, https://www.vusec.net/wp-content/uploads/2016/11/TalkGras.pdf Physical Memory 如何得到target程式所使用的各個 page table level的各個page offset ? 先找cache line offset再找cache line中的entry offset。
- 15. Cache Side-channel Attacks on MMU • In general, PRIME+PROBE • EVICT+TIME 利用Cache有share特性
- 16. PRIME+PROBE https://arxiv.org/pdf/1702.07521.pdf • 在heap建構TLB EVICT Buffer (size大於 unified TLB)，可使 dTLB flush • 建構JIT code，可使得 iTLB flush • 換成LLC 也可以做PRIME+PROBE攻擊
- 17. 需要OS漏洞操作core 0 為 attack core https://arxiv.org/pdf/1702.07521.pdf Software Grand Exposure: SGX Cache Attacks Are Practical
- 18. EVICT+TIME Repeat • Take a large enough set of memory pages to act as eviction set • Eviction set使TLB產生miss。 • 此cache line offset =page table的某一個level 的offset。對於x86_64，因為一個page table 有512 PT entry，9 bit中，6 bit表示cache line offset，3 bit表示 8 page table entry，所以已 解出6 bit。 page cache line offset TIME EVICT
- 19. • 剩下3 bit怎辦 ? • 可解cache line offset，但我怎知道是哪一個 page table level ? EVICT+TIME
- 20. EVICT+TIME • On X86_64，PTL1的一個page entry offset代 表的記憶體空間為? 4KB • On X86_64，PTL2的一個page entry offset代 表的記憶體空間為? 512*4KB = 2 MB • PTL3 (512*2MB) / PTL4類推 (512*1G) • 在TLB cache的存PTL1的cache line中的差一 個cache entry 代表 VM中差多少? 4KB
- 23. Reference • ASLR on the Line: Practical Cache Attacks on the MMU • ASLR^Cache: Practical Cache Attacks on the MMU • Software Grand Exposure: SGX Cache Attacks Are Practical • https://www.vusec.net/projects/anc/ • https://github.com/vusec/revanc