Meltdown漏洞：用户空间读取内核内存

需积分: 12 121 浏览量更新于2024-07-15 收藏 507KB PDF 举报

"本文档详细介绍了‘熔断’(Meltdown)漏洞，这是一个严重的安全问题，它利用现代处理器的乱序执行(out-of-order execution)特性，使得用户空间的程序能够非法访问内核内存，从而获取敏感信息，如个人数据和密码。此漏洞不仅影响Linux系统，还可能影响其他操作系统，并且不依赖于任何软件漏洞。" 在计算机安全领域，内存隔离是保障系统安全的基础。通常，内核地址空间被标记为非可访问，以防止用户空间的程序直接读取或修改内核数据。然而，“熔断”漏洞揭示了这一机制的潜在脆弱性。这个攻击方法是利用处理器的乱序执行功能，这是一种为了提高性能而广泛采用的技术。在乱序执行中，处理器可以预先执行一些指令，然后在后续的内存访问验证后回溯调整。 Meltdown攻击的核心在于，它可以绕过内存隔离，使用户进程能够读取原本应受保护的内核内存。由于攻击不依赖于特定的操作系统，这意味着无论是Linux、Windows还是macOS，只要其运行在受影响的处理器上，都可能成为攻击目标。此外，由于不依赖软件漏洞，防范这种攻击更为困难，因为传统的更新补丁方法可能无法完全解决问题。攻击者可以通过“熔断”获取的数据包括但不限于敏感的系统信息、个人隐私、密码以及其他关键的安全凭据。这可能导致严重的数据泄露，对个人用户和组织来说都是巨大的风险。例如，恶意应用可能利用此漏洞窃取用户的银行信息、加密货币钱包私钥或其他高价值数据。针对“熔断”漏洞的防御措施主要包括硬件和软件两方面。硬件层面，处理器制造商可能需要通过微代码更新来修复这个问题；软件层面，操作系统开发者需要发布补丁，限制用户空间对内核内存的非法访问。同时，用户也需要及时更新系统和硬件驱动，以获得最新的安全防护。 "熔断"漏洞揭示了硬件安全在现代计算中的重要性，提醒我们在追求性能的同时，不能忽视安全性。它也促进了安全研究和防护技术的发展，推动了硬件和软件厂商之间的紧密合作，以更好地保护用户的数据安全。

Physical memory

max

User

Kernel

−2

−1

Figure 2: The physical memory is directly mapped in the

kernel at a certain offset. A physical address (blue) which

is mapped accessible to the user space is also mapped in

the kernel space through the direct mapping.

are used to enforce privilege checks, such as readable,

writable, executable and user-accessible. The currently

used translation table is held in a special CPU register.

On each context switch, the operating system updates

this register with the next process’ translation table ad-

dress in order to implement per-process virtual address

spaces. Because of that, each process can only reference

data that belongs to its virtual address space. Each vir-

tual address space itself is split into a user and a kernel

part. While the user address space can be accessed by the

running application, the kernel address space can only be

accessed if the CPU is running in privileged mode. This

is enforced by the operating system disabling the user-

accessible property of the corresponding translation ta-

bles. The kernel address space does not only have mem-

ory mapped for the kernel’s own usage, but it also needs

to perform operations on user pages, e.g., ﬁlling them

with data. Consequently, the entire physical memory is

typically mapped in the kernel. On Linux and OS X, this

is done via a direct-physical map, i.e., the entire physi-

cal memory is directly mapped to a pre-deﬁned virtual

address (cf. Figure 2).

Instead of a direct-physical map, Windows maintains

a multiple so-called paged pools, non-paged pools, and

the system cache. These pools are virtual memory re-

gions in the kernel address space mapping physical pages

to virtual addresses which are either required to remain

in the memory (non-paged pool) or can be removed from

the memory because a copy is already stored on the disk

(paged pool). The system cache further contains map-

pings of all ﬁle-backed pages. Combined, these memory

pools will typically map a large fraction of the physical

memory into the kernel address space of every process.

The exploitation of memory corruption bugs often re-

quires knowledge of addresses of speciﬁc data. In or-

der to impede such attacks, address space layout ran-

domization (ASLR) has been introduced as well as non-

executable stacks and stack canaries. To protect the

kernel, kernel ASLR (KASLR) randomizes the offsets

where drivers are located on every boot, making attacks

harder as they now require to guess the location of kernel

data structures. However, side-channel attacks allow to

detect the exact location of kernel data structures [21, 29,

37] or derandomize ASLR in JavaScript [16]. A com-

bination of a software bug and the knowledge of these

addresses can lead to privileged code execution.

2.3 Cache Attacks

In order to speed-up memory accesses and address trans-

lation, the CPU contains small memory buffers, called

caches, that store frequently used data. CPU caches hide

slow memory access latencies by buffering frequently

used data in smaller and faster internal memory. Mod-

ern CPUs have multiple levels of caches that are either

private per core or shared among them. Address space

translation tables are also stored in memory and, thus,

also cached in the regular caches.

Cache side-channel attacks exploit timing differences

that are introduced by the caches. Different cache attack

techniques have been proposed and demonstrated in the

past, including Evict+Time [55], Prime+Probe [55, 56],

and Flush+Reload [63]. Flush+Reload attacks work on

a single cache line granularity. These attacks exploit the

shared, inclusive last-level cache. An attacker frequently

ﬂushes a targeted memory location using the clflush

instruction. By measuring the time it takes to reload the

data, the attacker determines whether data was loaded

into the cache by another process in the meantime. The

Flush+Reload attack has been used for attacks on various

computations, e.g., cryptographic algorithms [63, 36, 4],

web server function calls [65], user input [23, 47, 58],

and kernel addressing information [21].

A special use case of a side-channel attack is a covert

channel. Here the attacker controls both, the part that in-

duces the side effect, and the part that measures the side

effect. This can be used to leak information from one

security domain to another, while bypassing any bound-

aries existing on the architectural level or above. Both

Prime+Probe and Flush+Reload have been used in high-

performance covert channels [48, 52, 22].

3 A Toy Example

In this section, we start with a toy example, i.e., a simple

code snippet, to illustrate that out-of-order execution can

change the microarchitectural state in a way that leaks

information. However, despite its simplicity, it is used as

a basis for Section 4 and Section 5, where we show how

this change in state can be exploited for an attack.

Listing 1 shows a simple code snippet ﬁrst raising an

(unhandled) exception and then accessing an array. The

property of an exception is that the control ﬂow does not

continue with the code after the exception, but jumps to

an exception handler in the operating system. Regardless

剩余17页未读，继续阅读

rtoax

粉丝: 2736
资源: 216

Meltdown漏洞：用户空间读取内核内存

Meltdown attack_Whitepaper

spectre-meltdown-checker：针对Linux和BSD的Spectre，Meltdown，Foreshadow，Fallout，RIDL，ZombieLoad漏洞缓解检查器

高举性价比大旗 英特尔新旗舰之酷睿i9-10980XE处理器首测.pdf

利用工具检测Linux上是否存在Spectre& Meltdown 漏洞，知道该漏洞如何进行修复。 该两组漏洞是否还存在其他的检测方法？ 如何通过微代码对该漏洞进行修复？

bootargs = "qcom_dma_heaps.enable_bitstream_contig_heap=y kpti=0 ssbd=force-off lpm_levels.sleep_disabled=1 video=vfb:640x400,bpp=32,memsize=3072000 msm_rtb.filter=0x237

MeltDown攻击的基本指令及其解释

查询Linux源代码和相关资料，请简述Linux是如何管理其PCID的，并简述该机制如何能够帮助避免Meltdown漏洞。

简述Linux是如何管理其PCID的，并简述该机制如何能够帮助避免Meltdown漏洞。

最新资源

高举性价比大旗英特尔新旗舰之酷睿i9-10980XE处理器首测.pdf

利用工具检测Linux上是否存在Spectre& Meltdown 漏洞，知道该漏洞如何进行修复。该两组漏洞是否还存在其他的检测方法？如何通过微代码对该漏洞进行修复？