Malicious Management Unit: Why Stopping Cache Attacks in Software is Harder Than You Think
summary
Presents a new translation-probe indirect cache attack that lures the MMU into leaking victim cache usage by abusing page-table walks and undocumented translation caches, constructs eviction sets from shared pages and page-table entries, and measures covert-channel bandwidth and error rates. Demonstrates practical leakage against OpenSSL AES T‑tables, tests translation-cache behavior across 26 microarchitectures on Intel/AMD/ARM, and shows the attack bypasses common software defenses like page coloring and way partitioning.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:24Motivation
- 2:48PRIME + PROBE
- 6:16Page coloring
- 7:36XLATE attacks
- 8:00Page table walks
- 10:00Translation Caches
- 13:20Shared Memory
- 13:41Building Eviction Sets
- 16:07Challenges
- 17:13Reliability
- 17:30Effectiveness
- 17:50Cache Defenses
- 18:17Conclusions
related talks
35mPage Cache Attacks: Microarchitectural Attacks on Flawless Hardware
15mI Know What You Said: Unveiling Hardware Cache Side-Channels in Local Large
41mUsing Microarchitectural Design to Break KASLR and More
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...
34mGetting on the Same (Virtual Memory) Page: A Roundtable on Data-only Attack Mitigations
28mComplexity Killed Security
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM