Meltdown: Reading Kernel Memory from User Space

on YouTube ↗23m

" summary

Meltdown demonstrates that out of order execution leaks kernel memory by executing transient instructions that encode secret bytes into the cache and recovering them with a Flush+Reload cache side channel. It reads arbitrary physical memory, achieving about 582 KB/s when data hits L1, ~12.4 KB/s from L3 and only ~10 B/s for uncached lines (an improved method reaches ~3.2 KB/s). Mitigations include KAISER / KPTI; Intel CPUs are broadly affected, AMD mostly not, Apple devices are affected.

AI-written summary · about

" chapters (22)

1. 0:00Intro
2. 0:24Kernel addresses
3. 1:20Paging
4. 2:39Architecture
5. 4:10CPU Cache
6. 6:10Out of Order Execution
7. 7:27Toy Example
8. 8:08Building Blocks
9. 9:45Fault Handling
10. 10:32Cover Channel
11. 10:58Cache Attack
12. 11:58Meltdown Attack
13. 12:46New Experiment
14. 13:23Uncatchable Memory
15. 14:04Who is affected
16. 14:34Exynos Mongoose
17. 15:39Breaking the SLR
18. 16:34Locating a victim process
19. 17:05Using the physical address
20. 17:36Fixing the hardware
21. 18:14Kaiser
22. 19:56Conclusion

" related talks

• 24mThe Memory of a MeltdownShane Cota, Chris Magistrado · BSidesSF 2018
• 25mThe Memory of a MeltdownShane Cota, Chris Magistrado · BSidesSF 2018
• 43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the ProcessDaniel Gruss, Anders Fogh · Black Hat USA 2016
• 50mPractical Ghostbusting: Meltdown, Spectre and YouIan Coldwater · NDC Minnesota 2018
• 30mSpectre, Meltdown, & LinuxGreg Kroah-Hartman · LinuxCon + ContainerCon + CloudOpen China 2018
• 01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...Allison Randal, Giorgos Christou · RISC-V Summit 2022
• 19mKeynote: MDS, Fallout, Zombieland & LinuxGreg Kroah-Hartman · Open Source Summit + Embedded Linux Conference North America 2019
• 41mUsing Microarchitectural Design to Break KASLR and MoreAnders Fogh · RuhrSec 2017