Page Cache Attacks: Microarchitectural Attacks on Flawless Hardware
summary
Operating-system page cache acts as a software cache and yields non-destructive probes via APIs like mincore and QueryWorkingSet, enabling timing side channels used to build covert channels, UI overlays and RNG recovery. Practical results include a covert channel of 81.16 KB/s on Linux and 100.11 KB/s on Windows, a PHP RNG seed recovered within 1 millisecond after detecting microtime, eviction optimized to ~149 milliseconds on Linux, and kernel mitigation via mincore changes in Linux 5.1.4.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:15Micro Architecture
- 1:00CPU Cache
- 3:07Application Cache Attack
- 8:37Countermeasures
- 10:55Parallel Universe
- 13:13Page Cache
- 13:57Simplified Page Cache
- 15:50Observing Page Cache State
- 17:39Reset Page Cache State
- 18:39Linux
- 20:30Windows
- 21:51Sidechannel
- 23:48Pseudorandom Number Generator
- 26:37UI Redressing
- 29:34Windows countermeasures
- 32:37Performance optimization
- 33:20Conclusion
related talks
15mI Know What You Said: Unveiling Hardware Cache Side-Channels in Local Large
23mMalicious Management Unit: Why Stopping Cache Attacks in Software is Harder Than You Think
24mSide-Channel Attacks on Everyday Applications
41mUsing Microarchitectural Design to Break KASLR and More
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
42mAre Microarchitectural Attacks still possible on ...
51mExploiting Hardware Glitches And Side Channels In Perfect Software
24mThe Memory of a Meltdown