A group of researchers from the Graz University of Technology (Austria), previously known for developing attacks like MDS, NetSpectre, Throwhammer, and ZombieLoad, has published a new attack method (CVE-2021-3714) that exploits side channels on the memory deduplication mechanism, allowing the detection of specific data in memory, orchestrating byte-level memory content leakage, or determining memory layout to bypass address space layout randomization (ASLR) protections. Unlike previously demonstrated attacks on the deduplication mechanism, the new method conducts attacks from an external host, using response time differences to the attacker's requests sent via HTTP/1 and HTTP/2 protocols as the criterion. The feasibility of the attack has been demonstrated on servers running Linux and Windows.
Attacks on the memory deduplication mechanism use the time difference in processing write operations as a channel for leaking information. This occurs in situations where data modification leads to the cloning of a deduplicated memory page through the Copy-On-Write (COW) mechanism. The kernel identifies identical memory pages across different processes and merges them by mapping identical memory pages to a single physical memory area, storing only one copy. When one process attempts to modify data related to deduplicated pages, a page fault occurs, and a separate copy of the memory page is automatically created and assigned to that process via the Copy-On-Write mechanism. The copying process takes additional time, which may indicate data modifications intersecting with another process.
The researchers demonstrated that the delays caused by the COW mechanism can be detected not only locally but also by analyzing response delivery times over the network. Several methods for determining memory content from a remote host have been proposed through analyzing the execution time of requests sent over HTTP/1 and HTTP/2 protocols. Typical web applications that retain information from incoming requests in memory are used to maintain the patterns being identified.
The general principle of the attack involves filling in on server The memory page is filled with data that can potentially duplicate the content already present on the server's memory page. The attacker then waits for the time needed for the kernel to deduplicate and merge the memory page before modifying the controlled data duplicate and measuring the response time to determine the success of the attack.
In the conducted experiments, the maximum leakage speed was 34.41 bytes per hour during attacks through the global network and 302.16 bytes per hour during attacks through the local network, which is faster than other methods of data extraction through side channels (for example, the data transfer rate during a NetSpectre attack is 7.5 bytes per hour).
Three working attack options have been proposed. The first option allows for data retrieval from memory web server, which utilizes Memcached. The attack involves loading specific datasets into the Memcached storage, clearing the deduplicated block, rewriting the same item, and creating conditions for COW copying by altering the block's contents. In the experiment with Memcached, it was possible to determine the version of libc installed in the system running in a virtual machine in 166.51 seconds.
The second option allowed the content of records in the MariaDB database to be revealed when using the InnoDB storage, by reconstructing the content byte by byte. The attack is carried out by sending specially modified queries that result in one-byte mismatches in memory pages and analyzing the response time to determine whether the guess about the byte's content was correct. The speed of such leakage is low, at 1.5 bytes per hour when attacking from a local network. The advantage of the method is that it can be used to recover unknown content from memory.
The third option allowed for a complete bypass of the KASLR protection mechanism in 4 minutes, obtaining information about the offset in the memory image of the virtual machine's kernel, in a situation where the offset address is located in a memory page that does not have other data modified. The attack was conducted from a host located 14 hops away from the targeted system. Code examples for the presented attacks are promised to be published on GitHub.
Source: opennet.ru
