DisARMed: Attacking ARM TrustZone from Userspace with Memory Aliasing
summary
Shows a practical exploit that uses memory aliasing from userspace and huge-page spraying to find aliased physical DRAM, modify page tables from an unprivileged process, and remap memory to escalate to root and leak TrustZone-protected secrets. Proof-of-concept works on two of three 64-bit ARM platforms tested and extracts full process memory and keys. Includes a mitigation: an ARM trusted firmware alias scan patch that detects aliases at boot with ~1s boot overhead.
AI-written summary · about
chapters (8)
- 0:00DisARMed introduction
- 1:21Memory aliasing attacks
- 4:53ARM TrustZone overview
- 8:23User space attack challenges
- 13:22Huge pages for aliasing
- 15:08Attack implementation steps
- 16:32Proof of concept results
- 17:15Countermeasures and mitigation
related talks
43mBreaking Samsung's ARM TrustZone
39mReflections on Trusting TrustZone
41mUsing Microarchitectural Design to Break KASLR and More
01h 03mret2dir: Deconstructing Kernel Isolation
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
28mComplexity Killed Security
40mEvils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs
35mKSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features