Practical Timing Side Channel Attacks against Kernel Space ASLR

TLDR

ASLR, along with stack canaries and non‑executable memory, is widely deployed across modern desktop, server, and mobile operating systems to reduce the attack surface of control‑flow hijacking attacks when correctly implemented. The study investigates the weaknesses of kernel‑space ASLR against a local attacker with limited privileges. The authors design a generic side‑channel attack that exploits shared cache behavior in the memory‑management subsystem to infer privileged address‑space layout, implementing three variants that work on multiple x86 CPUs and virtual machines, and propose a low‑overhead mitigation. The attacks successfully bypass kernel‑space ASLR on current operating systems, demonstrating feasibility across four x86 CPUs and virtual machines.

Abstract

Due to the prevalence of control-flow hijacking attacks, a wide variety of defense methods to protect both user space and kernel space code have been developed in the past years. A few examples that have received widespread adoption include stack canaries, non-executable memory, and Address Space Layout Randomization (ASLR). When implemented correctly (i.e., a given system fully supports these protection methods and no information leak exists), the attack surface is significantly reduced and typical exploitation strategies are severely thwarted. All modern desktop and server operating systems support these techniques and ASLR has also been added to different mobile operating systems recently. In this paper, we study the limitations of kernel space ASLR against a local attacker with restricted privileges. We show that an adversary can implement a generic side channel attack against the memory management system to deduce information about the privileged address space layout. Our approach is based on the intrinsic property that the different caches are shared resources on computer systems. We introduce three implementations of our methodology and show that our attacks are feasible on four different x86-based CPUs (both 32- and 64-bit architectures) and also applicable to virtual machines. As a result, we can successfully circumvent kernel space ASLR on current operating systems. Furthermore, we also discuss mitigation strategies against our attacks, and propose and implement a defense solution with negligible performance overhead.