Home Europe Research Interest Group Meeting [May 2022]

Europe Research Interest Group Meeting [May 2022]


Remote Memory-Deduplication Attacks – Remotely Leaking Secrets via Same-Domain Deduplication

by Dan Gruss and Martin Schwarzl


Cloud providers use memory deduplication to reduce the memory utilization of their systems. Memory deduplication merges memory pages with identical content and maps them under a copy-on-write semantic. Previous work showed that memory deduplication can be exploited in a local scenario to perform ASLR breaks, Rowhammer attacks and fingerprint applications. Countermeasures have been proposed to disable memory deduplication across security domains. Memory deduplication was re-enabled within a security domain on Windows as well as on Linux server systems.

In this talk, we present remote memory-deduplication attacks. We show that memory-deduplication attacks are not only limited to local code execution by mounting powerful attacks over the internet. We demonstrate that web applications that use in-memory caching like Memcached can be remotely exploited without any user interaction. An attacker can use this remote timing side channel to leak sensitive information. Using amplification, our side channel leaks up to 34.41 B/h across the internet (14 hops). We show how fingerprinting can be performed on operating systems and shared libraries. Our remote KASLR break can break KASLR on a remote server in a few minutes via both HTTP/1.1 and HTTP/2. By using a leakage primitive to change the alignment of attacker-controlled data, we enable byte-by-byte data leakage of MySQL database records.

We evaluate state-of-the-art mitigations and argue that some are insufficient to mitigate remote memory-deduplication attacks. We outline challenges for future research on remote memory-deduplication attacks. Full technical details can be found in our NDSS 2022 paper “Remote Memory-Deduplication Attacks“.

Dan Gruss and Martin Schwarzl are researchers from the Institute of Applied Information Processing and Communications (IAIK) at the Graz University of Technology, Austria. Their research focuses on software-based attacks and defenses on microarchitectural layers in hardware and software.

Date

May 05 2022
Expired!

Time

8:00 am - 9:00 am

Local Time

  • Timezone: America/Los_Angeles
  • Date: May 05 2022
  • Time: 5:00 am - 6:00 am

More Info

Google Meet link

Location

Virtual

Organizer

Brno Research
Email
brno-research@redhat.com
Google Meet link

Submit a Comment

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.