Using Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
summary
An unprivileged prefetch instruction timing side channel reliably leaks where kernel pages are mapped and often reveals driver locations, breaking KASLR; measurement uses serialized rdtsc/CPUID sequences and cache flushes to build a translation oracle and an address translation oracle. Scans jump in half‑terabyte PML4 steps, produce a full kernel map in seconds-to-hours but typically locate a target driver in under one second, recover direct physical map offsets on Linux/macOS/EC2, and yield physical addresses that make practical Rowhammer and precise L3 cache attacks.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 4:00Memory subsystem mechanics
- 10:03Address translation process
- 14:05Operating system security
- 17:45Side-channel attack methods
- 23:30Timing and measurement issues
- 27:43Breaking KASLR case study
- 31:00Direct physical map exploits
- 36:05Advanced attacks and conclusion
related talks
41mUsing Microarchitectural Design to Break KASLR and More
37mDerandomizing Kernel Object Locations w Software Hardware-Induced Side Channels
23mMeltdown: Reading Kernel Memory from User Space
28mComplexity Killed Security
53mSilently Breaking ASLR In The Cloud
25mDRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks
33mExploring a New Class of Kernel Exploit Primitive
15mI Know What You Said: Unveiling Hardware Cache Side-Channels in Local Large