Rowhammer Software-exploitable Hardware Flaw

Transcript

1. Rowhammer Software-exploitable Hardware Flaw Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. An explanatory tutorial assembled by: Liang Gong
2. 2 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. References Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu: Flipping bits in memory without accessing them: an experimental study of DRAM disturbance errors in ISCA’14. Mark Seaborn and Thomas Dullien: Exploiting the DRAM rowhammer bug to gain kernel privileges, in Black Hat 2015. Moritz Lipp, Daniel Gruss, Raphael Spreitzer, Clementine Maurice, and Stefan Mangard: ARMageddon: Cache Attacks on Mobile Devices, in USENIX Security’16. Michael Schwarz and Anders Fogh: DRAMA: How Your DRAM Becomes a Security Problem, in Black Hat 2016. Daniel Gruss, Clémentine Maurice, Stefan Mangard: Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript, in DIMVA 2016
3. 3 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Motivation for presenting this work • Is JavaScript really memory-safe? • Is there any way to break out of a sandbox? • Full stack security attack – physics, hardware, computer architecture, OS, security, JavaScript
4. 4 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Motivation for presenting this work • Is JavaScript really memory-safe? • Is there any way to break out of a sandbox? • Full stack security attack (stack overflow) – physics, hardware, computer architecture, OS, security, JavaScript
5. 5 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Rowhammer - Impact • Software-exploitable hardware flaw • Cause bit flips in memory • Can be exploited to: – get root on a machine – escape from a sandbox – break out of a browser
6. 6 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Overview • Bit flips: –How to cause them –How to exploit them rowhammer attack
7. 7 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. The rowhammer DRAM bug • rowhammer: In DRAM, repeatedly activating rows can cause bit flips in adjacent rows. • Hardware bug in many DRAM modules since 2010 • Process can bypass memory protection and affect others • The three big DRAM manufacturer all shipped memory with this problem – A whole generation of machines
8. 8 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. The rowhammer DRAM bug • rowhammer: In DRAM, repeatedly activating rows can cause bit flips in adjacent rows. • Cannot choose which bit to flip, but can flip a bit fairly consistently
9. 9 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • bits are grouped into rows • rows are grouped into banks DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … …
10. 10 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • bits are grouped into rows • rows are grouped into banks Row activation: • Read row n to row buffer DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … …
11. 11 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • bits are grouped into rows • rows are grouped into banks Row activation: • Read row n to row buffer DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … …
12. 12 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • bits are grouped into rows • rows are grouped into banks Row activation: • Read row n to row buffer • row n is the “current row” DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … …
13. 13 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • bits are grouped into rows • rows are grouped into banks Row activation: • Read row n to row buffer • row n is the “current row” • Read row 1 to row buffer DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … …
14. 14 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • bits are grouped into rows • rows are grouped into banks Row activation: • Read row n to row buffer • row n is the “current row” • Read row 1 to row buffer DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … …
15. 15 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • bits are grouped into rows • rows are grouped into banks Row activation: • Read row n to row buffer • row n is the “current row” • Read row 1 to row buffer • Activate row 1 DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … …
16. 16 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • rowhammer: In DRAM, repeatedly activating rows can cause bit flips in adjacent rows. • Refresh: works like row activation • Cells are capacitors – they leak charge • So each row must be refreshed every 64 ms DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … …
17. DRAM: rows and row buffer • rowhammer: In DRAM, repeatedly activating rows can cause bit flips in adjacent rows. • Refresh: works like row activation • Cells are capacitors – they leak charge • So each row must be refreshed every 64 ms DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 17 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley.
18. DRAM: rows and row buffer • rowhammer: In DRAM, repeatedly activating rows can cause bit flips in adjacent rows. • Refresh: works like row activation • Cells are capacitors – they leak charge • So each row must be refreshed every 64 ms DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 18 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. transistor capacitor
19. DRAM: rows and row buffer • rowhammer: In DRAM, repeatedly activating rows can cause bit flips in adjacent rows. • Refresh: works like row activation • Cells are capacitors – they leak charge • So each row must be refreshed every 64 ms DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 19 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. transistor capacitor
20. DRAM: rows and row buffer • rowhammer: In DRAM, repeatedly activating rows can cause bit flips in adjacent rows. • Refresh: works like row activation • Cells are capacitors – they leak charge • So each row must be refreshed every 64 ms DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 20 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. transistor capacitor
21. 21 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • rowhammer: In DRAM, repeatedly activating rows can cause bit flips in adjacent rows. • Within refresh period, if row n is repeatedly activated • Row n±1 may get bit flips DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … …
22. 22 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • rowhammer: In DRAM, repeatedly activating rows can cause bit flips in adjacent rows. • Within refresh period, if row n is repeatedly activated • Row n±1 may get bit flips DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … transistor capacitor
23. 23 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • rowhammer: In DRAM, repeatedly activating rows can cause bit flips in adjacent rows. • Within refresh period, if row n is repeatedly activated • Row n±1 may get bit flips DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … transistor capacitor electromagnetic coupling electricity  magnetic field  electricity
24. 24 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM: rows and row buffer • rowhammer: In DRAM, repeatedly activating rows can cause bit flips in adjacent rows. • Within refresh period, if row n is repeatedly activated • Row n±1 may get bit flips DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … transistor capacitor electromagnetic coupling electricity  magnetic field  electricity
25. 25 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Bad Cells • Often consistently flipped when hammered • Randomly distributed • Have preferred directions: 0  1 or 1  0 • “Badness” varies by DRAM module: – % of rows with bad cells: • varies from 30% to 99.9% – # of activations causing failure: • can be as low as 98,000 • Max # allowed by spec:1,300,000
26. 26 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Bad Cells • Often consistently flipped when hammered • Randomly distributed • Have preferred directions: 0  1 or 1  0 • “Badness” varies by DRAM module: – % of rows with bad cells: • varies from 30% to 99.9% – # of activations causing failure: • can be as low as 98,000 • Max # allowed by spec:1,300,000 Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu: Flipping bits in memory without accessing them: an experimental study of DRAM disturbance errors in ISCA’14.
27. 27 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Overview • Bit flips: –How to trigger them –How to exploit them rowhammer attack
28. 28 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Overview • Bit flips: –How to trigger them –How to exploit them rowhammer attack
29. 29 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Overview • Bit flips: –How to trigger them –How to exploit them rowhammer attack Main obstacle to perform this attack: CPU Caches
30. 30 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Intel Multi-core Architecture DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … Core L1 D L1 I L2 Core L1 D L1 I L2 LLC – Last Level Cache
31. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Intel Multi-core Architecture DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … Core L1 D L1 I L2 Core L1 D L1 I L2 LLC – Last Level Cache 31
32. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Intel Multi-core Architecture DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … Core L1 D L1 I L2 Core L1 D L1 I L2 LLC – Last Level Cache 32 L1 Cache L2 Cache L3 Cache
33. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Intel Multi-core Architecture DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … Core L1 D L1 I L2 Core L1 D L1 I L2 LLC – Last Level Cache 33 L1 Cache L2 Cache L3 Cache Inclusive cache  only need to invalidate L3 Cache
34. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … Core L1 D L1 I L2 Core L1 D L1 I L2 LLC – Last Level Cache 34 L3 Cache Inclusive cache  only need to invalidate L3 Cache rowhammer attack 1. bypass the cache
35. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … Core L1 D L1 I L2 Core L1 D L1 I L2 LLC – Last Level Cache 35 L3 Cache Inclusive cache  only need to invalidate L3 Cache • Intel x86: Unprivileged clflush instruction rowhammer attack 1. bypass the cache
36. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … Core L1 D L1 I L2 Core L1 D L1 I L2 LLC – Last Level Cache 36 L3 Cache Inclusive cache  only need to invalidate L3 Cache • Intel x86: Unprivileged clflush instruction • ARM: Privileged cache maintenance instructions rowhammer attack 1. bypass the cache
37. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … Core L1 D L1 I L2 Core L1 D L1 I L2 LLC – Last Level Cache 37 L3 Cache Inclusive cache  only need to invalidate L3 Cache • Intel x86: Unprivileged clflush instruction • ARM: Privileged cache maintenance instructions Moritz Lipp, Daniel Gruss, Raphael Spreitzer, Clementine Maurice, and Stefan Mangard: ARMageddon: Cache Attacks on Mobile Devices, in USENIX Security’16. rowhammer attack 1. bypass the cache
38. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … Core L1 D L1 I L2 Core L1 D L1 I L2 LLC – Last Level Cache 38 L3 Cache Inclusive cache  only need to invalidate L3 Cache • Intel x86: Unprivileged clflush instruction rowhammer attack 1. bypass the cache
39. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … Core L1 D L1 I L2 Core L1 D L1 I L2 LLC – Last Level Cache 39 L3 Cache Inclusive cache  only need to invalidate L3 Cache • Intel x86: Unprivileged clflush instruction clflush operand operand is a byte memory location • No way to disable it rowhammer attack 1. bypass the cache
40. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … 40 rowhammer attack 1. bypass the cache 2. activate two different rows • Keep reading row n will not activate it row 2 row n+2 row n+3 …
41. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 41 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank row 2 row n+2 row n+3
42. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 42 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank Infer from hardware and OS info • Difficult to pick virtual addresses mapping to the same DRAM bank • Virtual addr  physical addr  DRAM location row 2 row n+2 row n+3
43. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 43 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank Infer from hardware and OS info • Difficult to pick virtual addresses mapping to the same DRAM bank • Virtual addr  physical addr  DRAM location Just pick it randomly • 16 banks  1/16 chance to be in the same bank row 2 row n+2 row n+3
44. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 44 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank Infer from hardware and OS info • Difficult to pick virtual addresses mapping to the same DRAM bank • Virtual addr  physical addr  DRAM location Just pick it randomly • 16 banks  1/16 chance to be in the same bank Select addresses using timing • “different row, same bank” should be slower row 2 row n+2 row n+3
45. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 45 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank Infer from hardware and OS info • Difficult to pick virtual addresses mapping to the same DRAM bank • Virtual addr  physical addr  DRAM location Just pick it randomly • 16 banks  1/16 chance to be in the same bank Select addresses using timing • “different row, same bank” should be slower row 2 row n+2 row n+3 row hits row conflicts Michael Schwarz and Anders Fogh: DRAMA: How Your DRAM Becomes a Security Problem, in Black Hat 2016.
46. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 46
47. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 47 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank • Double-sided hammering row 2 row n+2 row n+3
48. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 48 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank • Double-sided hammering row 2 row n+2 row n+3
49. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 49 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank • Double-sided hammering • If keep activating row n and row n + 2, then row n + 1 will have a better chance to be flipped. row 2 row n+2 row n+3
50. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 50 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank • Double-sided hammering • If keep activating row n and row n + 2, then row n + 1 will have a better chance to be flipped. • Need to experiment with the architecture of the victim machine row 2 row n+2 row n+3
51. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 51 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank • Double-sided hammering • If keep activating row n and row n + 2, then row n + 1 will have a better chance to be flipped. • Need to experiment with the architecture of the victim machine • Extrapolate the distance (e.g.,256K) row 2 row n+2 row n+3
52. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 52 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank code1a: mov (X), %eax mov (Y), %ebx clflush (X) clflush (Y) mfence jmp code1a row 2 row n+2 row n+3
53. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. DRAM bank row buffer row 0 row 1 row n-1 row n row n+1 … … 53 rowhammer attack 1. bypass the cache 2. activate two different rows in the same bank code1a: mov (X), %eax clflush (X) mfence jmp code1a row 2 row n+2 row n+3
54. 54 Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. Overview • Bit flips: –How to trigger them –How to exploit them rowhammer attack
55. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 55 Exploitation Example • Break a Sandbox – NaCI sandbox only allows a subset of x86 instr – break the NaCI sandbox to make system calls • Gain Kernel Privileges – gain access to all physical memory from a normal x86-64 process in Linux
56. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 56 Exploitation Example • Break a Sandbox – NaCI sandbox only allows a subset of x86 instr – break the NaCI sandbox to make system calls • Gain Kernel Privileges – gain access to all physical memory from a normal x86-64 process in Linux
57. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 57 NaCI in-process sandbox • Sandbox for running C/C++ - “native code” on the web • Used in the Google Chrome browser • WebAssembly is being defined by teams members from NaCI at Google. How it works: • Load an x86-64 executable • Use a validator to check the safety
58. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 58 NaCI in-process sandbox How it works: • Load an x86-64 executable • Use a validator to check the safety
59. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 59 NaCI in-process sandbox How it works: • Load an x86-64 executable • Use a validator to check the safety Vulnerable: • Once a code is validated, it is considered safe • Idea: hammer the validated code area to cause bit flip – Safe code  unsafe code
60. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 60 NaCI in-process sandbox How it works: • Load an x86-64 executable • Use a validator to check the safety Vulnerable: • Once a code is validated, it is considered safe • Idea: hammer the validated code area to cause bit flip – Safe code  unsafe code • The “safe code” memory area is visible in NaCI !
61. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 61 NaCI Security Policy • always jump within the sandbox memory space • NaCI validator checks that all jmp instructions are used in the following sequence 83 e0 e1 andl $~31, %eax // Truncate address to 32 bits // and mask to be 32-byte-aligned. 4c 01 f8 addq %r15,%rax // Add %r15, the sandbox // base address. ff e0 jmp *%rax // Indirect jump.
62. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 62 NaCI Security Policy • always jump within the sandbox memory space • NaCI validator checks that all jmp instructions are used in the following sequence safe code area in memory (Instr are 32 byte aligned) mov X, %rcx andl $~31, %eax addq %r15,%rax jmp *%rax
63. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 63 NaCI Security Policy • always jump within the sandbox memory space • NaCI validator checks that all jmp instructions are used in the following sequence • Sandbox also ensures that it will not jump out of the box • No syscall instr loaded Goal: execute a syscall. How? safe code area in memory (Instr are 32 byte aligned) mov X, %rcx andl $~31, %eax addq %r15,%rax jmp *%rax
64. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 64 NaCI Security Policy • always jump within the sandbox memory space • NaCI validator checks that all jmp instructions are used in the following sequence • Sandbox also ensures that it will not jump out of the box • No syscall instr loaded Goal: execute a syscall. How? Hammering the code area  flips safe code area in memory (Instr are 32 byte aligned) mov X, %rcx andl $~31, %eax addq %r15,%rax jmp *%rax
65. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 65 NaCI Security Policy • always jump within the sandbox memory space • NaCI validator checks that all jmp instructions are used in the following sequence 83 e0 e1 andl $~31, %eax // Truncate address to 32 bits // and mask to be 32-byte-aligned. 4c 01 f8 addq %r15,%rax // Add %r15, the sandbox // base address. ff e0 jmp *%rax // Indirect jump.
66. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 66 NaCI Security Policy • always jump within the sandbox memory space • NaCI validator checks that all jmp instructions are used in the following sequence 83 e0 e1 andl $~31, %eax // Truncate address to 32 bits // and mask to be 32-byte-aligned. 4c 01 f8 addq %r15,%rax // Add %r15, the sandbox // base address. ff e0 jmp *%rax // Indirect jump. Suppose there is a bit flip: %rax  %rcx
67. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 67 NaCI Security Policy • always jump within the sandbox memory space • NaCI validator checks that all jmp instructions are used in the following sequence • Sandbox also ensures that it will not jump out of the box • No syscall instr loaded Goal: execute a syscall. How? Hammering the code area  flips Jump to the middle of another instr safe code area in memory (Instr are 32 byte aligned) evil instruction mov X, %rcx andl $~31, %eax addq %r15,%rax jmp *%rcx
68. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 68 Break NaCI 20ea0: 48 b8 0f 05 eb 0c f4 f4 f4 f4 movabs $0xf4f4f4f40ceb050f, %rax 20ea2: 0f 05 syscall 20ea4: eb 0c jmp ... // Jump 20ea4: f4 hlt // padding evil instruction mov 20ea2, %rcx andl $~31, %eax addq %r15,%rax jmp *%rcx
69. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 69 Break NaCI 20ea0: 48 b8 0f 05 eb 0c f4 f4 f4 f4 movabs $0xf4f4f4f40ceb050f, %rax 20ea2: 0f 05 syscall 20ea4: eb 0c jmp ... // Jump 20ea4: f4 hlt // padding evil instruction mov 20ea2, %rcx andl $~31, %eax addq %r15,%rax jmp *%rcx NaCI Validated: • jump within the sandbox memory space • all jmp instructions are used in the specific sequence • No syscall instr loaded (explicitly) syscall instr is still called
70. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 70 Exploitation Example • Break a Sandbox – NaCI sandbox only allows a subset of x86 instr – break the NaCI sandbox to make system calls • Gain Kernel Privileges – gain access to all physical memory from a normal x86-64 process in Linux
71. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 71 Exploitation Example • Break a Sandbox – NaCI sandbox only allows a subset of x86 instr – break the NaCI sandbox to make system calls • Gain Kernel Privileges – gain access to all physical memory from a normal x86-64 process in Linux
72. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 72 Hammering Page Table Virtual Addr Space Physical Memory
73. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 73 Hammering Page Table Virtual Addr Space Physical Memory
74. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 74 Hammering Page Table Virtual Addr Space Physical Memory Create lots of mapping to the same memory space • Use the mmap function
75. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 75 Hammering Page Table Virtual Addr Space Physical Memory Create lots of mapping to the same memory space • Use the mmap function Start hammering the memory
76. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 76 Hammering Page Table Virtual Addr Space Physical Memory Create lots of mapping to the same memory space • Use the mmap function Start hammering the memory If lucky…
77. Liang Gong, Electric Engineering & Computer Science, University of California, Berkeley. 77 Hammering Page Table Virtual Addr Space Physical Memory Create lots of mapping to the same memory space • Use the mmap function Start hammering the memory If lucky… Now you can write the page table  you have access to any physical memory