Method of Timing Attack for Linux Against KASLR

• Published in: Jisuanji gongcheng
• Main Author: CONG Mou, ZHANG Ping, WANG NING
• Format: Article
• Language: English
• Published: Editorial Office of Computer Engineering 2021-08-01
• Subjects: kernel address space layout randomization (kaslr)|prefetch instruction|timing attack|kernel|cache miss
• Online Access: https://www.ecice06.com/fileup/1000-3428/PDF/20210823.pdf

For Linux systems with Kernel Address Space Layout Randomization(KASLR) protection, this paper proposes a Cache instant attack method based on CPU prefetch instruction. When the prefetch instructions of Intel CPU prefetch data that is not mapped to physical address, a Cache failure will occur, resulting in the consumption of CPU clock cycles longer than the data mapped to physical address. According to this feature, the CPU clock cycle consumption is obtained by using the rdtscp instruction, and the protection of KASLR technology is bypassed by using timing attacks, so as to accurately obtain the Offset of kernel address mapping. Experimental results show that this attack method can bypass the KASLR protection of Linux operating system to obtain the accurate mapping location of kernel address, and avoid causing a large number of Cache failures.