利用分支预测器绕过ASLR的安全研究

36 浏览量更新于2024-08-25 收藏 896KB PDF 举报

"Jump Over ASLR - Attacking Branch Predictors to Bypass ASLR - 2016 (micro16)" 是一篇关于计算机安全的研究论文，由Dmitry Evtyushkin、Dmitry Ponomarev和Nael Abu-Ghazaleh共同撰写。这篇论文探讨了如何利用分支预测器来绕过地址空间布局随机化（ASLR）这一广泛使用的安全防御技术。地址空间布局随机化（ASLR，Address Space Layout Randomization）是操作系统为了防止恶意攻击而采用的一种方法，它通过随机化程序在虚拟内存中的位置，使得攻击者难以确定特定代码对象的地址，从而难以控制程序流程。ASLR主要针对缓冲区溢出、返回导向编程（ROP）等类型的攻击提供保护。论文中，作者提出了一种新的攻击策略，称为“Jump Over ASLR”。这种攻击利用了分支目标缓冲区（BTB，Branch Target Buffer）的侧信道攻击。BTB是现代处理器中用于优化分支指令执行的一种硬件结构，它存储了最近的分支目标地址，以提高预测分支目标的准确性。攻击者通过创建其进程中的分支指令与受害者用户级程序或代表内核执行的分支指令之间的BTB冲突。这些冲突允许攻击者获取内核和用户级ASLR的偏移量，即使ASLR已经启用，也能有效地破坏其安全性。具体来说，攻击过程包括以下步骤： 1. 创建BTB碰撞：攻击者精心设计并执行特定的分支序列，使得它们的分支目标与受害者程序或内核的分支目标在BTB中发生冲突。 2. 监测和分析：通过监控这些碰撞，攻击者可以推断出受害者程序或内核的某些部分在内存中的相对位置。 3. 利用信息：一旦获得了足够的信息，攻击者就能精确地定位关键代码的位置，从而绕过ASLR，执行恶意代码。这项研究揭示了ASLR并非无懈可击，硬件级别的优化如分支预测器也可能成为攻击的入口。因此，对于系统安全研究人员和开发者而言，理解并防范这类攻击至关重要，可能需要对ASLR的实现进行改进，或者寻找新的防御机制来应对这种新型攻击。此外，该论文还可能讨论了防御此类攻击的方法，如增强BTB的安全性，限制对BTB的访问，或者使用更复杂的随机化策略来增加攻击的难度。这样的研究对于提高软件和系统的整体安全性具有深远的意义。

B. Attack on User Process ASLR

In this case, we assume that two user processes are present

in the system. The ﬁrst process is a process that is the

target of an attack typically because it runs as root or has

permissions to access sensitive data. We refer to this process

as the victim process. The other process is the spy process

and it is controlled by the attacker who seeks to recover

ASLR of the victim as a ﬁrst step of further attacks on it.

We assume that the system supports ASLR and the victim is

compiled as a position-independent executable to fully beneﬁt

from it. As a result, the segments in the process image are

randomly shifted in virtual memory. We assume that there are

no weaknesses in the ASLR implementation and the spy does

not have any means to directly obtain the randomized ASLR

offset, for example via a memory disclosure vulnerability. The

spy can only execute normal user-level instructions, including

instructions for time measurement. The spy can also perform

regular interactions with the victim via any interfaces it offers,

for example via initializing network connections.

We assume that the spy can achieve virtual core co-

residency with the victim process. This assumption is required

because BTB collisions can only be achieved within the

same virtual core on Haswell CPU. This assumption is not

unrealistic because, as we demonstrate in Section V-A, it is

possible for the spy to control the cores on which the victim

process is scheduled.

III. CREATING THE BTB SIDE-CHANNEL

Branch predictors are critical to performance of modern pro-

cessors. One of the main components of the branch prediction

hardware is the Branch Target Buffer (BTB). The BTB stores

target addresses of recently executed branch instructions, so

that those addresses can be obtained directly from a BTB

lookup to fetch instructions starting at the target in the next cy-

cle. Since the BTB is shared by several applications executing

on the same core, information leakage from one application

to another through the BTB side-channel is possible. For

example, several previous works demonstrated the feasibility

of recovering secret encryption key bits using branch predictor

side channel [27], [28]. As another example, a recent study

of [29], [30] demonstrated that a reliable and high speed covert

communication channel can be created between two malicious

applications that share the branch prediction logic.

In this paper we describe a new security threat associ-

ated with shared branch prediction hardware. Speciﬁcally, we

demonstrate how a user-level spy process can gain information

about the position of code blocks in the address space of either

a victim process or the kernel by aligning its code to intention-

ally create BTB collisions between these two address spaces.

The attacker performs a series of time measurements, each

to test a hypothesis about the location of a speciﬁc branch.

These experiments allow the attacking process to discover the

precise location of a branch in the kernel address space, or

the address space of another process, thus bypassing kernel-

level ASLR and user level ASLR respectively. In principle,

our approach has a potential to bypass even some recently

proposed ﬁne-grained ASLR solutions [31], [32], [33], [34].

The BTB side-channel that we exploit in this paper for

attacking ASLR is based on creating BTB collisions between

unconditional branch instructions belonging to two different

execution entities. We consider two types of collisions: col-

lisions between two user-level processes (to attack user-level

ASLR) and collisions between user-level and the kernel (to

attack KASLR). While no speciﬁc BTB addressing details are

needed by the attacker to perform the attack on the user-level

process, some reverse-engineering and understanding of the

BTB addressing scheme is required for an attack on the kernel.

A. Creating BTB Collisions in User Space

To create a BTB-based side-channel, three conditions must

be satisﬁed. First, one application has to ﬁll a BTB entry by

executing a branch instruction. Second, the execution time

of another application running on the same core must be

affected by the state of the BTB. This condition is satisﬁed

when both applications use the same BTB entry, perhaps with

different targets stored. Third, the second application must be

able to detect the impact on its execution by performing time

measurements. We call the BTB collisions created between

two processes executing in the same protection domain (e.g.

two user-level processes) as Same-Domain Collisions (SDC).

An example of a SDC collision that can be exploited by our

attack is shown in Figure 1.

Kernel space Kernel space

User space User space

BTB

Address tag Target

jmp1 jmp2

0x7fefebe45a82

0xebe45a82

0x7fefebe45ad6

Fig. 1: SDC Example

To verify the sufﬁciency of the above assumptions for

creating SDCs, we designed and conducted the following

experiment on a machine with an Intel Haswell processor.

We executed two processes on the system: the victim and the

spy. The victim process writes some data into the BTB by

executing branch instructions. The goal of the spy process is

to use the branch instructions and time measurement tools

to detect the information that was written to the BTB by

the victim process. Since the goal of this experiment is to

demonstrate the possibility of data transmission through the

BTB side-channel, we allow the victim and the spy to coor-

dinate their actions by communicating with each other using

剩余12页未读，继续阅读

weixin_38715721

粉丝: 5
资源: 965

利用分支预测器绕过ASLR的安全研究

在内核中修补ASLR幻灯片生成的工具，以在32位iOS上禁用用户界面ASLR-C/C++开发

ASLR-Removal:重塑

aslr.rar_ASLR_Minix ASLR_aslr minix_space

seLINUX如何启用ASLR

Could not disable address space layout randomization (ASLR).

make menuconfig配置项中的 (8) Number of bits to use for ASLR of mmap base address 介绍

return-to-libc attac

vs2022怎么开启ASLR

ASLR是通过哪两个方面实现的？如何实现

最新资源