Breaking Kernel Address Space Layout Randomization (KASLR) With Intel TSX
summary
A new attack called DrK uses Intel Transactional Synchronization Extensions to time aborted transactions and distinguish unmapped, mapped non‑executable, and mapped executable pages, turning that into an address‑disclosure channel. It scans thousands of 4 KB pages and identifies kernel and module layouts with near‑perfect accuracy — reported 100% accuracy for Linux/Windows/OS X, 0.1s on Linux to probe ~6,000 pages and practical speed on cloud instances — and leaves no OS-visible fault.
AI-written summary · about
chapters (25)
- 0:00Intro
- 1:28Example: Linux
- 3:23Example: town. OS X 10.10.5 Kernel Privilege Escalation Vulnerability
- 3:55Kernel Address Space Layout Randomization (KASLR)
- 6:29TLB Timing Side Channel
- 13:35TSX Gives Better Precision on Timing Attack
- 14:50Transactional Synchronization Extension
- 18:06Abort Handler Suppresses Exceptions
- 19:38Reducing Noise with Intel TSX
- 20:07Measuring Timing Side Channel
- 28:09Demo 2: Full Attack on Linux
- 32:22Attack on Windows
- 33:39Attack on OS X
- 34:00Attack on Amazon EC2
- 34:30Result Summary
- 34:55Timing Side Channel (M/U)
- 36:17Path for a mapped Page
- 39:20Intel Cache Architecture
- 40:58Path for an Executable Page
- 41:36Path for a non-executable, but mapped Page
- 42:26Cache Coherence and TLB
- 44:43Discussions: Controlling Noise
- 47:03Discussions: Countermeasures?
- 49:34Conclusion
- 50:17Any Question?
related talks
41mUsing Microarchitectural Design to Break KASLR and More
37mDerandomizing Kernel Object Locations w Software Hardware-Induced Side Channels
45mBreaking and Protecting Linux Kernel Stack
49mBypassing KPTI Using the Speculative Behavior of the SWAPGS Instruction
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation
36mStore-to-Leak Forwarding: There and Back Again
59mSanitizing the Linux Kernel — On KASAN and other Dynamic Bug-finding Tools
49mKVM Address Space Isolation