Remote Memory-Deduplication Attacks
summary
Remote memory‑deduplication is practical over the Internet without running attacker code: sending and overwriting pages via memcache d (tested on KVM on Ubuntu across 14 hops with packet captures and async I/O) yields a covert channel and fingerprinting, a KASLR break in about four minutes, and byte‑wise leakage from InnoDB by abusing page reorganization and amplification. Throughput measures roughly 34 bytes/hour for the covert channel. Mitigations that work include Fusion timing equalization and a probabilistic Linux opt‑in; full disablement or per‑page encryption are costly.
AI-written summary · about
chapters (9)
- 0:00Introduction and setup
- 1:25Remote deduplication attacks
- 3:39Memory deduplication mechanics
- 7:23Network-based exploit model
- 11:33Challenges and amplification
- 13:53Fingerprinting and techniques
- 17:53Breaking KASLR remotely
- 19:33Database record leakage
- 26:34Mitigations and conclusion
related talks
53mSilently Breaking ASLR In The Cloud
15mDUPEFS: Leaking Data Over the Network With Filesystem Deduplication Side Channels
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
01h 03mret2dir: Deconstructing Kernel Isolation
25mDRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks
34mGetting on the Same (Virtual Memory) Page: A Roundtable on Data-only Attack Mitigations
23mMeltdown: Reading Kernel Memory from User Space
51mExploiting Hardware Glitches And Side Channels In Perfect Software