Using Microarchitectural Design to Break KASLR and More
summary
Demonstrates concrete methods that let an unprivileged process and even sandboxed code locate kernel mappings and modules by abusing microarchitectural features: a prefetch-based probe that loads page-table entries into caches and maps kernel pages in minutes, a TSX abort timing variant that removes page-fault noise where available, and a BTB lower-31-bit leak that recovers partial kernel addresses. Reconstructs virtual→physical mappings to aid Rowhammer and cache attacks, shows prefetch works on almost all CPUs, TSX is rarer, and kernel-per-process (CR3 swap) fixes cost <<1% in practice.
AI-written summary · about
chapters (12)
- 0:00Introduction to KASLR
- 2:56Paging and kernel security
- 7:48Paging cache vulnerabilities
- 9:01KASLR bypass mechanics
- 11:52Double page fault attacks
- 17:03TSX exploitation techniques
- 21:04Prefetch instruction attacks
- 23:42Kernel mapping mitigations
- 26:47Real-world attack case studies
- 29:29Advanced kernel isolation
- 31:55Branch target buffer attacks
- 37:02Conclusion and future outlook
related talks
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
50mBreaking Kernel Address Space Layout Randomization (KASLR) With Intel TSX
51mKeynote |The Microarchitectures That I Saw And The Ones That I Hope To One Day See
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation
28mComplexity Killed Security
49mBypassing KPTI Using the Speculative Behavior of the SWAPGS Instruction
01h 03mret2dir: Deconstructing Kernel Isolation
36mStore-to-Leak Forwarding: There and Back Again