Meltdown: Reading Kernel Memory from User Space

Authors: Mortiz Lipp, Michael Schwarz, Daniel Gruss, et. al
Venue: arXiv

This paper is one of the massive mainstream security vulnerabilities exposed in 2018 for CPUs. The attack initially was independent of software vulnerabilities, and works even with the presence of KASLR/ASLR. The attack is based off speculative execution, which can result in what they call "transient instructions". These instructions begin execution, but do not finish so there is no change in architectural state. However, their are micro-architectural artifacts, which can be exploited via the Flush+Reload attack methodology. There are three main details worth explaining that are non-trivial:

1. Exception handling. When the program attempts to read from kernel memory, this will cause an exception. One way to handle this is via having the exception happen on a separate thread. However, an even more elegant solution is to put the attack in Intel TSX (transactional memory). In this case, an exception is not even raised, we are just notified the transaction fails. However, the micro-architectural state difference will still be present.

2. Getting into kernel code. Prior to this vuln, nearly all operating systems map the kernel into the user space memory in the upper portion of the address space. This allows for faster context switches as you do not have to switch page tables for every system call. By simply indexing into the upper address space, we can gain entry to the kernel.

3. Dealing with KASLR. The kernel code is randomized in the address space, however, it is only randomized with 40 bits. Assuming 8GB of memory, there are only 128 probe locations, which is easy enough.

The fix: See KAISER / KPTL: Kernel Page Table Isolation. Essentially, we can no longer map the kernel into the address space of user processes.

Full Text

Comments

Post a Comment

Popular posts from this blog

Fundamental Latency Trade-offs in Architecting DRAM Caches (Alloy Cache)

Authors: Moinuddin K. Qureshi and Gabriel H. Loh Venue:    MICRO 2012 The authors present a new architecture for DRAM cache which targets optimizing latency rather than hit rate. The authors show that for every optimization made to improve hit rate, one must also consider the added cache latency, thus resulting in a new "break even hit rate". The authors compare to three key baselines: an infeasibly large SRAM-tag array, the prior "LH-Cache", and a ideal latency-optimized cache. They find that "unoptimizations" improve latency, while minimally impacting hit-rate. Their final result is a cache which boosts performance 35% improvement over the baseline, and nearly 20% better than the previous LH-cache. The specific contributions are: Moving to a direct mapped cache provides significant improvement (by reducing latency) Combining tag-store and data-store into a single entity improves performance 21% Implementing a small per-core predictor enhances per...
Read more

ZCOMP: Reducing DNN Cross-Layer Memory Footprint Using Vector Extensions

Authors: Berkin Akin, Zeshan A. Christi, and Alaa R. Alameldeen Venue: MICRO, 2019 With accelerators dominating the deep learning space in architecture conferences, this paper stands out as it focuses on reducing DNN inference/training overhead while using a CPU. An obvious question is, with the wide-spread use of GPUs/TPUs for deep learning, why should we focus on optimizing CPUs for deep learning. In a recent paper published at HPCA 2019, Facebook claims that CPUs are preferred for applications where a tight integration is required between DNN and non-DNN tasks. Also, Intel's recent AVX512 has specialized support for DNNs in the form of new instructions called Vector Neural Network Instructions (VNNI). Broadly, optimizing DNNs can be viewed from two different perspectives; computation, and communication. This paper targets reducing communication overhead, more specifically, activation or feature-map communication overhead by compressing them. Compressing activations/weights...
Read more

AutoFDO: Automatic Feedback-Directed Optimization for Warehouse-Scale Applications

Authors: Dehao Chen, David Xinliang Li, Tipp Moseley Venue:    CGO 2016 This paper presents AutoFDO, a system used which profiles warehouse-scale applications, and applies feedback to the compilation for the next release. AutoFDO works by profiling and storing profiles in an aggregate database, annotating the profiles via an intermediate representation, and finally providing feedback. On average, this technique boosts performance by around 10% and works well even with stale releases. For profiles to be useful, they must be in an intermediate representation. This is built from binary-level profile, which uses LBR to map instruction frequencies. By using these frequencies, program counters, and the source, a source profile can be generated. The source profile can be used to build an annotated call-graph with edge frequencies, with some inaccuracy. These annotated call-graphs can then be used as feedback to the compiler. Because of the size of the applications and scale of d...
Read more