Silently Breaking ASLR In The Cloud
summary
Demonstrates a practical side‑channel that uses memory deduplication (KSM/Page‑fusion) by measuring slow copy‑on‑write times to detect shared pages, then brute‑forces the 19‑bit image base by allocating all candidate first pages in RAM. The authors build CAIN PoC, implement an adaptive sleep‑time detection and multi‑round filtering/verifications, and reliably break ASLR in <5 hours against a 64‑bit Windows Server 2012 guest on default KVM; suggested mitigation is disabling page deduplication.
AI-written summary · about
chapters (17)
- 0:00Breaking ASLR in the cloud
- 1:07Threat scenario assumptions
- 2:53Memory deduplication pitfalls
- 4:14ASLR leakage via side channel
- 5:59Attack construction challenges
- 9:51Brute-forcing base addresses
- 11:58Adaptive sleep detection
- 14:08Detecting merged pages
- 16:36False positives elimination
- 18:42Proof of concept setup
- 21:10Evaluation results
- 28:34Live Kane attack demo
- 33:29Attack impact and implications
- 37:45Real-world applicability
- 41:38Vendor mitigations
- 44:26Key takeaways
- 45:36Q&A
related talks
31mRemote Memory-Deduplication Attacks
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
58mExploiting Linux and Pax ASLR's Weaknesses on 32-Bit and 64-Bit Systems
33mOver the Edge: Silently Owning Windows 10's Secure Browser
41mUsing Microarchitectural Design to Break KASLR and More
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
24mShielding Software From Privileged Side-Channel Attacks
51mExploiting Hardware Glitches And Side Channels In Perfect Software