Derandomizing Kernel Object Locations w Software Hardware-Induced Side Channels
summary
Two separate, practical location-disclosure attacks: a hash-table timing method that uses POSIX-timer and futex syscalls to detect bucket occupancy, induces hash collisions, and reduces kernel-heap search from ~2^46 to ~2^35.5 (23 slab placements) to find an mm_struct in under a minute; and a TLB prefetch side channel that uses prefetched page translations plus controlled syscalls to load specific pages and leak 4 KB-aligned kernel heap, stacks, and page-table pages. Both are demonstrated on recent Ubuntu kernels and work across Intel/AMD/ARM hardware; proposed mitigations (randomized hash input, CPU fixes) either increase cost or shift responsibility.
AI-written summary · about
chapters (9)
- 0:00Introduction and motivation
- 3:38Kernel exploitation challenges
- 10:23Software-induced side channel
- 17:18Live demo and results
- 17:59Address translation basics
- 23:01Hardware-induced side channel
- 30:50Second live demo
- 31:22Discussion and takeaways
- 33:45Q&A session
related talks
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
30mProactive Software Defense against Side Channel Attacks
50mBreaking Kernel Address Space Layout Randomization (KASLR) With Intel TSX
41mUsing Microarchitectural Design to Break KASLR and More
51mExploiting Hardware Glitches And Side Channels In Perfect Software
15mI Know What You Said: Unveiling Hardware Cache Side-Channels in Local Large
34mGetting on the Same (Virtual Memory) Page: A Roundtable on Data-only Attack Mitigations
28mComplexity Killed Security