Upload File

kaveh razavi mmu magic in javascript: erik bosman ...powerofcommunity.net/poc2017/ben.pdfget secrets...

  • Home
  • Documents
  • Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g
97
Ben Gras Kaveh Razavi Erik Bosman Herbert Bos Cristiano Giuffrida VU Amsterdam 1 MMU Magic in JavaScript: Breaking ASLR from a Sandbox

Upload: lythuan

Post on 08-Jun-2018

215 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Ben GrasKaveh RazaviErik BosmanHerbert BosCristiano Giuffrida

VU Amsterdam

1

MMU Magic in JavaScript: Breaking ASLR from a Sandbox

Page 2: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Done at ..❖ VUSec systems security academic research group

❖ Defensive & offensive security projects using systems techniques

❖ VU University in Amsterdam

❖ I am an intern with Cisco ASRG now

2

Page 3: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Teaser

❖ Compute virtual addresses of data & code

❖ With microarchitectural MMU side channel, not software

❖ Thereby breaking ASLR

❖ On all modern CPU models - Intel, AMD, ARM

❖ Even from JavaScript

3

Page 4: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Teaser❖ Visualization - JavaScript - and no software bug

❖ There will be a demo video

4

Page 5: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

5

Big picture: cached page tables

Cache Set

Page

Page 6: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Outline❖ Background: ASLR & Side Channels

❖ Pagetable walks

❖ CPU Caches

❖ EVICT+TIME

❖ JavaScript

❖ Results

❖ Demo

6

Page 7: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

ASLR❖ Main justification

❖ Response to exploitation in the 90s

Application

Stack0xbfffffff

ExecNon-Exec

0x08048000

0xbffffxyz0x90909090SHELLCODE

7

Page 8: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

ASLR❖ Let’s randomize both areas: ASLR

❖ Also DEP. So exploitation requires ASLR leak and ROP

Stack0x????????

ExecNon-Exec

0x8048abc0x8048defSHELLCODE

0x????????Application

8

Page 9: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Side Channels

❖ Get secrets by measuring out of the box

❖ Side effect outside the system

❖ e.g. Stethoscopes

❖ e.g. Power analysis

❖ e.g. Timing

❖ e.g. RF

9

Page 10: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Outline❖ Background: ASLR & Side Channels

❖ Pagetable walks

❖ CPU Caches

❖ EVICT+TIME

❖ JavaScript

❖ Results

❖ Demo

10

Page 11: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

11

❖ Page tables point to the next step in a tree

Page 12: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

12

CR3: Level 4 Physical Addr

0x644b321f400011001000100101100110010000111110100000000000000

Page 13: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

13

CR3: Level 4 Physical Addr

Level 4

0x644b321f400011001000100101100110010000111110100000000000000

Page 14: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

14

CR3: Level 4 Physical Addr

Level 4

0x644b321f400011001000100101100110010000111110100000000000000

Page 15: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

15

PTE 200: Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4

0x644b321f400011001000100101100110010000111110100000000000000

Page 16: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

16

PTE 200: Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4 Level 3

0x644b321f400011001000100101100110010000111110100000000000000

Page 17: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

17

PTE 200: Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4 Level 3

0x644b321f400011001000100101100110010000111110100000000000000

Page 18: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

18

PTE 200: Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4 Level 3

PTE 300: Level 2 Phys Addr

0x644b321f400011001000100101100110010000111110100000000000000

Page 19: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

19

PTE 200: Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4 Level 3 Level 2

PTE 300: Level 2 Phys Addr

PTE 400: Level 1 Phys Addr

0x644b321f400011001000100101100110010000111110100000000000000

Page 20: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

20

PTE 200: Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4 Level 3 Level 2 Level 1

PTE 300: Level 2 Phys Addr

PTE 400: Level 1 Phys Addr

PTE 500: Target Phys Addr

0x644b321f400011001000100101100110010000111110100000000000000

Page 21: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

21

PTE 200: Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4 Level 3 Level 2 Level 1

PTE 300: Level 2 Phys Addr

PTE 400: Level 1 Phys Addr

PTE 500: Target Phys Addr

0x644b321f400011001000100101100110010000111110100000000000000

TLB

Page 22: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

22

PTE 200: Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4 Level 3 Level 2 Level 1

PTE 300: Level 2 Phys Addr

PTE 400: Level 1 Phys Addr

PTE 500: Target Phys Addr

0x644b321f400011001000100101100110010000111110100000000000000

TLB

VAddr PAddr

Page 23: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Pagetable Walks From DRAM

23

PTE 200: Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4 Level 3 Level 2 Level 1

PTE 300: Level 2 Phys Addr

PTE 400: Level 1 Phys Addr

PTE 500: Target Phys Addr

0x644b321f400011001000100101100110010000111110100000000000000

TLB

VAddr PAddr

PT Data Cache

Page 24: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Outline❖ Background: ASLR & Side Channels

❖ Pagetable walks

❖ CPU Caches

❖ EVICT+TIME

❖ JavaScript

❖ Results

❖ Demo

24

Page 25: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

CPU Caches❖ Memory cache lines can only go into one small cache set

25

Cache

DRAM

Cache Set

Page 26: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

26

Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 27: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

27

Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 28: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

28

1Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 29: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

29

1Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 30: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

30

1 2Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 31: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

31

1 2Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 32: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

32

1 2 3Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 33: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

33

1 2 3Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 34: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

34

1 2 3 7Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 35: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

35

1 2 3 7Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 36: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

36

1 2 3 7 18Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 37: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

37

1 2 3 7 18Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 38: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

38

1 2 3 7 18

17Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 39: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

39

1 2 3 7 18

17Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 40: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

40

1 2 3 17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 41: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

41

1 2 3 17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 42: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

42

1 2 3

22

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 43: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

43

1 2 3

22

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 44: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

44

1 22 3

12

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 45: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

45

1 22 3

12

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 46: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

46

1 12 3

2

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 47: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

47

1 12 3

2

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 48: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

48

1 2 3

22

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 49: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

49

1 2 3

22

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 50: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

50

1 22 3

12

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 51: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

51

1 22 3

12

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 52: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

52

1 12 3

2

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 53: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

53

1 12 3

2

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 54: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

54

1 2 3

22

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 55: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

55

1 2 3

22

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 56: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

56

1 22 3

12

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 57: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

57

1 22 3

12

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 58: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Tiny Cache Example

❖ 2-way cache, 5 sets per page, showing 2 colors

❖ Eviction sets follow page offsets

58

1 12 3

2

17 18

27Cache

DRAM1 2 3 4 5

11 12 13 14 15

6 7 8 9 10

16 17 18 19 20

21 22 23 24 25 26 27 28 29 30

Cache Set

Page 59: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

59

Big picture: cached page tables

Cache Set

Page

Page 60: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Outline❖ Justification: ASLR

❖ Pagetable walks

❖ CPU Caches

❖ EVICT+TIME

❖ JavaScript

❖ Results

❖ Demo

60

Page 61: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME

❖ Flush TLB, forcing pagetable walk

❖ 2x to measure cached lookup time

❖ Flush TLB

❖ Evict first cacheline

❖ Measure possibly-uncached lookup time

❖ Find cacheline dependencies

61

Page 62: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

62

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25 26 27 28 29 30

PTE 200: Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4 Level 3 Level 2 Level 1

PTE 300: Level 2 Phys Addr

PTE 400: Level 1 Phys Addr

PTE 500: Target Phys Addr

0x644b321f400011001000100101100110010000111110100000000000000

TLB

VAddr PAddr

Page 63: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

63

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25 26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

Page 64: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

64

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

Page 65: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

65

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Do address lookup

Page 66: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

66

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Do address lookup

Page 67: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

67

24 Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ It was uncached - slow

Page 68: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

68

24 Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Let’s do it again

Page 69: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

69

24 Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ It was cached - fast

Page 70: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

70

24 Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Let’s evict

Page 71: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

71

24 Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Let’s evict

Page 72: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

72

24 15 Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Let’s evict

Page 73: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

73

24 15 Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Let’s evict

Page 74: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

74

24 155

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Let’s evict

Page 75: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

75

24 155

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Eviction done - let’s do lookup

Page 76: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

76

24 155

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Eviction done - let’s do lookup

Page 77: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

77

24 155

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Still cached

Page 78: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

78

24 155

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Let’s evict

Page 79: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

79

24 155

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Let’s evict

Page 80: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

80

24 1514 5

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Let’s evict

Page 81: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

81

24 1514 5

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Let’s evict

Page 82: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

82

14 154 5

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Let’s evict

Page 83: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

83

14 154 5

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Eviction done - let’s do lookup

Page 84: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

84

14 154 5

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Eviction done - let’s do lookup

Page 85: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

EVICT+TIME in Cache

85

14 154 5

Cache

DRAM1 2 3 4 511 12 13 14 15

6 7 8 9 1016 17 18 19 20

21 22 23 24 25

26 27 28 29 30

PTE 200:Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4Level 3

Level 2Level 1

PTE 300:Level 2 Phys Addr

PTE 400:Level 1 Phys Addr

PTE 500:Target Phys Addr

0x644b321f4000

11001000100101100110010000111110100000000000000

TLB

VAddr

PAddr

Pagetable in DRAM

❖ Uncached now

Page 86: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

❖ 2 sources of ambiguity remaining

❖ Which are the 4 levels

❖ 8 slots per cacheline

❖ 4! *8*8*8*8=98304 (17 bits entropy)

❖ We have to vary the target

❖ This varies the slots

Ambiguity

86

PTE 200: Level 3 Phys Addr

CR3: Level 4 Physical Addr

Level 4 Level 3 Level 2 Level 1

PTE 300: Level 2 Phys Addr

PTE 400: Level 1 Phys Addr

PTE 500: Target Phys Addr

0x644b321f400011001000100101100110010000111110100000000000000

Page 87: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Outline❖ Background: ASLR & Side Channels

❖ Pagetable walks

❖ CPU Caches

❖ EVICT+TIME

❖ JavaScript

❖ Results

❖ Demo

87

Page 88: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

JavaScript Complications

❖ A security boundary: sandbox

❖ There are some complications

❖ Instruction re-ordering

❖ Low resolution timer

❖ Contiguous virtual address space

88

❖ For code: a large block of JIT

❖ Return right away

❖ Don’t forget to flush the iTLB

Prototypes in Firefox and Chrome

Page 89: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Outline❖ Background: ASLR & Side Channels

❖ Pagetable walks

❖ CPU Caches

❖ EVICT+TIME

❖ JavaScript

❖ Results

❖ Demo

89

Page 90: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Results: speed

0 3 6 9

12 15 18 21 24 27 30 33 36

0 10 20 30 40 50

Rem

aini

ng v

irtua

l add

ress

ent

ropy

(bits

)

Elapsed time (s)

Chrome heap (PTL3 cacheline crossing)Firefox heap (PTL3 cacheline crossing)Firefox heap (PTL4 cacheline crossing)

Firefox JIT (PTL2 cacheline crossing)

90

Page 91: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Results: tested microarchitectures

91

CPU Model Microarchitecture Year

Intel Xeon E3-1240 v5 Skylake 2015

Intel Core i7-6700K Skylake 2015

Intel Celeron N2840 Silvermont 2014

Intel Xeon E5-2658 v2 Ivy Bridge EP 2013

Intel Atom C2750 Silvermont 2013

Intel Core i7-4500U Haswell 2013

Intel Core i7-3632QM Ivy Bridge 2012

Intel Core i7-2620QM Sandy Bridge 2011

Intel Core i5 M480 Westmere 2010

Intel Core i7 920 Nehalem 2008

AMD FX-8350 8-Core Piledriver 2012

AMD FX-8320 8-Core Piledriver 2012

AMD FX-8120 8-Core Bulldozer 2011

AMD Athlon II 640 X4 K10 2010

AMD E-350 Bobcat 2010

AMD Phenom 9550 4-Core K10 2008

Allwinner A64 ARM Cortex A53 2016

Samsung Exynos 5800 ARM Cortex A15 2014

Samsung Exynos 5800 ARM Cortex A7 2014

Nvidia Tegra K1 CD580M-A1 ARM Cortex A15 2014

Nvidia Tegra K1 CD570M-A1 ARM Cortex A15; LPAE 2014

Page 92: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Outline❖ Background: ASLR & Side Channels

❖ Pagetable walks

❖ CPU Caches

❖ EVICT+TIME

❖ JavaScript

❖ Results

❖ Demo

92

Page 93: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

93

Page 94: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Reception

❖ Intel, AMD, ARM: CVE 2017-5925, 2017-5926, 2017-5927

❖ Chrome, Firefox, Safari, Edge: CVE-2017-5928

❖ Apple mitigation in iOS, Safari and tvOS updates

❖ Thank you NCSC-NL

94

Page 95: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Conclusion❖ There is an micro-architectural MMU cache side channel

❖ Exploitable from JavaScript

❖ It breaks ASLR in sandboxed environments

❖ Project page: https://www.vusec.net/projects/anc/

❖ Native code: https://github.com/vusec/revanc

❖ Twitter @vu5ec

95

https://www.vusec.net/projects/anc/
https://github.com/vusec/revanc
Page 96: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Results: reliability

0 0.2 0.4 0.6 0.8

1

Chrome 3 Levels Firefox 3 Levels Firefox 4 Levels

False positiveFalse negative

Success rate

96

Page 97: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g

Results: noise❖ Repeat measurements vs confidence margin

97


Pwning Microsoft Edge Browser: From Memory …powerofcommunity.net/poc2018/jin.pdfexploitation have rapidly evolved, especially for those high-risk applications, such as Microsoft

Narrative & Exposition - Stanford House · Nouns (e.g. wildlife, water, birds) Pronouns (e.g. I, they, you) Adjectives (e.g. fresh, beautiful) Sensing verbs (e.g. think, feel) Adverbial

Small Scale ecosystems. Micro habitats e.g. under leaf Habitats e.g. freshwater pond Zones e.g. layers of the rain forest Biomes e.g. Tropical rainforest

Ability Tests Sensory (e.g., hearing, vision) Motor/Physical (e.g., dexterity, strength, agility) Cognitive (e.g., intelligence, aptitude)

Measuring Scholarly Impact and · communication – Topic modeling (e.g., Latent DirichletAllocation) – Information Extraction (e.g., OpenIE) – Social Network Analysis (e.g.,

Windows 10 Control Flow Guard Internals - Power Of …powerofcommunity.net/poc2014/mj0011.pdf · Windows 10 Control Flow Guard ... • It relys on compile and link level processing

RINGHADDY DAFFODILS 2013 - DaffLibrary · Disquiet Queen’s Guard Sherpa Lighthouse Reef Goldfinger Drumlin White Star Trumpet Warrior e.g. e.g. e.g. e.g. Causeway Sunset Cape Point

Attack Certificate-based Authentication System and ...powerofcommunity.net/poc2009/xu.pdf•Attack Smart Card •Demo •Conclusion 2009/11/05 For POC2009 2. Background •Old password

CO ZIP Codes · PDF fileCounty ZIP Code US Interstate US Highway State Highway e.g. Jefferson e.g. 47957 e.g. I-70 e.g. US-1 e.g. State Route 40 Colorado ZIP Codes Adams ... CO ZIP

THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT

The New Ways to Attack Applications On Operating Systems under …powerofcommunity.net/poc2006/ex.pdf · 2018-01-08 · Applications On Operating Systems under Execshield The New

Immunotherapy: The Newest Treatment RouteDiversity of Approaches for Anticancer Immunotherapy Galuzzi et al, Oncotarget 2014 e.g. Rituxan e.g. CAR-T cells e.g. Revlimid e.g. Checkpoint

New Reliable Android Kernel Root Exploitation …powerofcommunity.net/poc2016/x82.pdfNew Reliable Android Kernel Root Exploitation Techniques INetCop Security dong-hoon you (x82) 2016-11-11

YEAR4CURRICULUM INFORMATIONBOOKLET · • Collect’andclassify’words’with common’roots,’e.g.’invent,’ prevent.’’ • Buildwords’from’other’words’with similar’meanings,’e.g

Embedded devices, an AntiVirus-free safe hideout for ...powerofcommunity.net/poc2010/ch.pdf · IS YOUR GAMING CONSOLE SAFE? Embedded devices, an AntiVirus-free safe hideout for Malware

e.g., - repository.lib.ncsu.edu

Integration e.g

Embedded security researcher,fresh Dr. :)powerofcommunity.net/poc2015/andrei.pdf · 2018-01-08 · –Legacy systems, no (security) updates •Have a large attack surface –Web interfaces

Learner name: School/Centre name: Teacher/Tutor name · • Face to face (e.g. a live presentation) • Audio (e.g. a podcast) • Visual (e.g. facial expression) • Virtual (e.g

KOMUNIKASI VERBAL DAN NON VERBAL · non-verbal communication/ body language eye movements (e.g. winking) posture (e.g. slouching) appearance (e.g. untidiness) head movements (e.g

Playing with IE11 ActiveX 0days - Power Of Communitypowerofcommunity.net/poc2017/james.pdf• The ways to render HTML in Internet Explorer 11 • IE11 Information disclosure and Content

Wall mounted case - nVent...e.g. special colours, special sizes e.g. air conditioning e.g. fittings, conversions, cut-outs e.g. custom solutions Overview . . . . . 2.24 epcase 19"

Make LoadLibrary Great Again - Power Of Communitypowerofcommunity.net/poc2017/yunhai.pdf · 2018. 1. 9. · KERNELBASE!LoadLibraryW is always a valid target. Mitigation in Windows

Kimchi: A Binary Rewriting Defense against Format String ...powerofcommunity.net/poc2006/lo.pdfContents Kimchi: Format String Defense 2 / 51 1 Research Motivation 2 Research Background

Junk DNA domestic imported (e.g., dead genes) (e.g., retroviruses)

Issue 23 - IMM...ASTM D4287 ASTM D5125 ASTM D562 ISO 2431 ISO 2884-1 e.g…..± 0.05 P e.g 3.24.± 0.02 P e.g…..± 0.05 P e.g 2.78.± 0.03 P Density e.g. ISO 2811-4 e.g…..± 0.05

How To Cook Cisco Exploit Development For Cisco IOSpowerofcommunity.net/poc2017/george.pdf · Killing the Myth of Cisco Diversity Ang Cyi Cisco IOS Techniques: • interrupt-Hijack

DESIGN GAME PECHA KUCHA 2010. Strategy Games (e.g. Red Alert) Simulation Games (e.g. Formula 1) Board Games (e.g. Poker) Arcade Games (e.g. Soccer)

Immobility. Degrees of mobility Complete immobility e.g. unconscious patient Complete immobility e.g. unconscious patient Partial mobility e.g. patient

Security on FHIR - FHIR DevDays€¦ · (e.g. Wordpress) Secure Website (e.g. Patient Portal) Service Proxy (e.g. LDAP) Internal Service (e.g. LDAP) Logging Services. X. Phoenix FHIR®

Let there be DevOps · e.g., OpenStack Horizon CLI e.g., OpenStack CLI Config. management e.g., OpenStack HEAT Automatic changes e.g., Scaling policies Ops Engineers Autonomic managers

Original Article Artigo Original phonological development ... · epenthesis (e.g..: bruxa – [bu’ɾuʃa]), merger (e.g..: cravo – [´davu]), compensatory stretching (e.g.: planta

Welcome to Free Anonymous Internet World - Power Of …powerofcommunity.net/poc2008/dugo.pdf · Welcome to Free Anonymous Internet World SAMUEL KOO [email protected] JIHONG YOON

Re: Application for the addition of Whole Blood and Red ...€¦ · anticoagulants (e.g., citrate), nutrients (e.g., dextrose), buffers (e.g., phosphate), and preservatives (e.g.,

Bug Fixes Reduce costs (e.g.: Self Service) Reduce costs (e.g.: Simplified Recovery) Integrating with existing systems (e.g.: SCCM) Provide