EntryBleed: A Universal KASLR Bypass against KPTI on Linux
For years, attackers have compromised systems by developing exploits that rely on known locations of kernel code and data segments. KASLR (Kernel Address Space Layout Randomization) is a key mitigation in modern operating systems which hampers these attacks through runtime randomization of the kerne...
| Main Authors: | , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | English |
| Published: |
ACM|Hardware and Architectural Support for Security and Privacy 2023
2023
|
| Online Access: | https://hdl.handle.net/1721.1/152917 |
| _version_ | 1826212235476729856 |
|---|---|
| author | Liu, William Ravichandran, Joseph Yan, Mengjia |
| author2 | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory |
| author_facet | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Liu, William Ravichandran, Joseph Yan, Mengjia |
| author_sort | Liu, William |
| collection | MIT |
| description | For years, attackers have compromised systems by developing exploits that rely on known locations of kernel code and data segments. KASLR (Kernel Address Space Layout Randomization) is a key mitigation in modern operating systems which hampers these attacks through runtime randomization of the kernel image base address. KPTI (Kernel Page Table Isolation) is another defense mechanism, originally introduced to defend against the 2018 Meltdown attack by unmapping kernel addresses during user code execution. This security mechanism makes it harder for attackers to leak kernel address mappings through micro-architectural side channels. However, a few pages for system call and interrupt handling were exempted from isolation for the sake of user to kernel context transitions.
We present the EntryBleed vulnerability (CVE-2022-4543) as a universal bypass against the KASLR protection mechanism through a combination of micro-architectural side channels and design flaws in the KPTI mitigation on Intel CPUs. We demonstrate that the bug we identified can accurately de-randomize the kernel address space within a second on modern Intel CPUs in both physical host and hardware-accelerated virtual machine environments. We then provide a root cause analysis to locate the core micro-architectural behaviors that enable EntryBleed, both on physical and under virtualized environments. Furthermore, we propose a performant mitigation based closely upon a pre-existing KASLR hardening mechanism. If left unpatched, attackers will be able to easily bypass KASLR, greatly lowering the barrier for exploit development and increasing the risk of serious threats against the Linux operating system. |
| first_indexed | 2024-09-23T15:18:30Z |
| format | Article |
| id | mit-1721.1/152917 |
| institution | Massachusetts Institute of Technology |
| language | English |
| last_indexed | 2024-09-23T15:18:30Z |
| publishDate | 2023 |
| publisher | ACM|Hardware and Architectural Support for Security and Privacy 2023 |
| record_format | dspace |
| spelling | mit-1721.1/1529172024-01-11T20:44:27Z EntryBleed: A Universal KASLR Bypass against KPTI on Linux Liu, William Ravichandran, Joseph Yan, Mengjia Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory For years, attackers have compromised systems by developing exploits that rely on known locations of kernel code and data segments. KASLR (Kernel Address Space Layout Randomization) is a key mitigation in modern operating systems which hampers these attacks through runtime randomization of the kernel image base address. KPTI (Kernel Page Table Isolation) is another defense mechanism, originally introduced to defend against the 2018 Meltdown attack by unmapping kernel addresses during user code execution. This security mechanism makes it harder for attackers to leak kernel address mappings through micro-architectural side channels. However, a few pages for system call and interrupt handling were exempted from isolation for the sake of user to kernel context transitions. We present the EntryBleed vulnerability (CVE-2022-4543) as a universal bypass against the KASLR protection mechanism through a combination of micro-architectural side channels and design flaws in the KPTI mitigation on Intel CPUs. We demonstrate that the bug we identified can accurately de-randomize the kernel address space within a second on modern Intel CPUs in both physical host and hardware-accelerated virtual machine environments. We then provide a root cause analysis to locate the core micro-architectural behaviors that enable EntryBleed, both on physical and under virtualized environments. Furthermore, we propose a performant mitigation based closely upon a pre-existing KASLR hardening mechanism. If left unpatched, attackers will be able to easily bypass KASLR, greatly lowering the barrier for exploit development and increasing the risk of serious threats against the Linux operating system. 2023-11-06T19:13:27Z 2023-11-06T19:13:27Z 2023-10-29 2023-11-01T07:58:25Z Article http://purl.org/eprint/type/ConferencePaper 979-8-4007-1623-2 https://hdl.handle.net/1721.1/152917 Liu, William, Ravichandran, Joseph and Yan, Mengjia. 2023. "EntryBleed: A Universal KASLR Bypass against KPTI on Linux." PUBLISHER_CC en https://doi.org/10.1145/3623652.3623669 Creative Commons Attribution Noncommercial https://creativecommons.org/licenses/by-nc/4.0/ The author(s) application/pdf ACM|Hardware and Architectural Support for Security and Privacy 2023 Association for Computing Machinery |
| spellingShingle | Liu, William Ravichandran, Joseph Yan, Mengjia EntryBleed: A Universal KASLR Bypass against KPTI on Linux |
| title | EntryBleed: A Universal KASLR Bypass against KPTI on Linux |
| title_full | EntryBleed: A Universal KASLR Bypass against KPTI on Linux |
| title_fullStr | EntryBleed: A Universal KASLR Bypass against KPTI on Linux |
| title_full_unstemmed | EntryBleed: A Universal KASLR Bypass against KPTI on Linux |
| title_short | EntryBleed: A Universal KASLR Bypass against KPTI on Linux |
| title_sort | entrybleed a universal kaslr bypass against kpti on linux |
| url | https://hdl.handle.net/1721.1/152917 |
| work_keys_str_mv | AT liuwilliam entrybleedauniversalkaslrbypassagainstkptionlinux AT ravichandranjoseph entrybleedauniversalkaslrbypassagainstkptionlinux AT yanmengjia entrybleedauniversalkaslrbypassagainstkptionlinux |