kaveh razavi mmu magic in javascript: erik bosman ...powerofcommunity.net/poc2017/ben.pdfget secrets...
TRANSCRIPT
![Page 1: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/1.jpg)
Ben GrasKaveh RazaviErik BosmanHerbert BosCristiano Giuffrida
VU Amsterdam
1
MMU Magic in JavaScript: Breaking ASLR from a Sandbox
![Page 2: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/2.jpg)
Done at ..❖ VUSec systems security academic research group
❖ Defensive & offensive security projects using systems techniques
❖ VU University in Amsterdam
❖ I am an intern with Cisco ASRG now
2
![Page 3: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/3.jpg)
Teaser
❖ Compute virtual addresses of data & code
❖ With microarchitectural MMU side channel, not software
❖ Thereby breaking ASLR
❖ On all modern CPU models - Intel, AMD, ARM
❖ Even from JavaScript
3
![Page 4: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/4.jpg)
Teaser❖ Visualization - JavaScript - and no software bug
❖ There will be a demo video
4
![Page 5: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/5.jpg)
5
Big picture: cached page tables
Cache Set
Page
![Page 6: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/6.jpg)
Outline❖ Background: ASLR & Side Channels
❖ Pagetable walks
❖ CPU Caches
❖ EVICT+TIME
❖ JavaScript
❖ Results
❖ Demo
6
![Page 7: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/7.jpg)
ASLR❖ Main justification
❖ Response to exploitation in the 90s
Application
Stack0xbfffffff
ExecNon-Exec
0x08048000
0xbffffxyz0x90909090SHELLCODE
7
![Page 8: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/8.jpg)
ASLR❖ Let’s randomize both areas: ASLR
❖ Also DEP. So exploitation requires ASLR leak and ROP
Stack0x????????
ExecNon-Exec
0x8048abc0x8048defSHELLCODE
0x????????Application
8
![Page 9: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/9.jpg)
Side Channels
❖ Get secrets by measuring out of the box
❖ Side effect outside the system
❖ e.g. Stethoscopes
❖ e.g. Power analysis
❖ e.g. Timing
❖ e.g. RF
9
![Page 10: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/10.jpg)
Outline❖ Background: ASLR & Side Channels
❖ Pagetable walks
❖ CPU Caches
❖ EVICT+TIME
❖ JavaScript
❖ Results
❖ Demo
10
![Page 11: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/11.jpg)
Pagetable Walks From DRAM
11
❖ Page tables point to the next step in a tree
![Page 12: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/12.jpg)
Pagetable Walks From DRAM
12
CR3: Level 4 Physical Addr
0x644b321f400011001000100101100110010000111110100000000000000
![Page 13: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/13.jpg)
Pagetable Walks From DRAM
13
CR3: Level 4 Physical Addr
Level 4
0x644b321f400011001000100101100110010000111110100000000000000
![Page 14: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/14.jpg)
Pagetable Walks From DRAM
14
CR3: Level 4 Physical Addr
Level 4
0x644b321f400011001000100101100110010000111110100000000000000
![Page 15: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/15.jpg)
Pagetable Walks From DRAM
15
PTE 200: Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4
0x644b321f400011001000100101100110010000111110100000000000000
![Page 16: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/16.jpg)
Pagetable Walks From DRAM
16
PTE 200: Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4 Level 3
0x644b321f400011001000100101100110010000111110100000000000000
![Page 17: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/17.jpg)
Pagetable Walks From DRAM
17
PTE 200: Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4 Level 3
0x644b321f400011001000100101100110010000111110100000000000000
![Page 18: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/18.jpg)
Pagetable Walks From DRAM
18
PTE 200: Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4 Level 3
PTE 300: Level 2 Phys Addr
0x644b321f400011001000100101100110010000111110100000000000000
![Page 19: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/19.jpg)
Pagetable Walks From DRAM
19
PTE 200: Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4 Level 3 Level 2
PTE 300: Level 2 Phys Addr
PTE 400: Level 1 Phys Addr
0x644b321f400011001000100101100110010000111110100000000000000
![Page 20: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/20.jpg)
Pagetable Walks From DRAM
20
PTE 200: Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4 Level 3 Level 2 Level 1
PTE 300: Level 2 Phys Addr
PTE 400: Level 1 Phys Addr
PTE 500: Target Phys Addr
0x644b321f400011001000100101100110010000111110100000000000000
![Page 21: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/21.jpg)
Pagetable Walks From DRAM
21
PTE 200: Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4 Level 3 Level 2 Level 1
PTE 300: Level 2 Phys Addr
PTE 400: Level 1 Phys Addr
PTE 500: Target Phys Addr
0x644b321f400011001000100101100110010000111110100000000000000
TLB
![Page 22: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/22.jpg)
Pagetable Walks From DRAM
22
PTE 200: Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4 Level 3 Level 2 Level 1
PTE 300: Level 2 Phys Addr
PTE 400: Level 1 Phys Addr
PTE 500: Target Phys Addr
0x644b321f400011001000100101100110010000111110100000000000000
TLB
VAddr PAddr
![Page 23: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/23.jpg)
Pagetable Walks From DRAM
23
PTE 200: Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4 Level 3 Level 2 Level 1
PTE 300: Level 2 Phys Addr
PTE 400: Level 1 Phys Addr
PTE 500: Target Phys Addr
0x644b321f400011001000100101100110010000111110100000000000000
TLB
VAddr PAddr
PT Data Cache
![Page 24: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/24.jpg)
Outline❖ Background: ASLR & Side Channels
❖ Pagetable walks
❖ CPU Caches
❖ EVICT+TIME
❖ JavaScript
❖ Results
❖ Demo
24
![Page 25: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/25.jpg)
CPU Caches❖ Memory cache lines can only go into one small cache set
25
Cache
DRAM
Cache Set
![Page 26: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/26.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
26
Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 27: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/27.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
27
Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 28: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/28.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
28
1Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 29: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/29.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
29
1Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 30: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/30.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
30
1 2Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 31: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/31.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
31
1 2Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 32: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/32.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
32
1 2 3Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 33: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/33.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
33
1 2 3Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 34: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/34.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
34
1 2 3 7Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 35: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/35.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
35
1 2 3 7Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 36: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/36.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
36
1 2 3 7 18Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 37: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/37.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
37
1 2 3 7 18Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 38: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/38.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
38
1 2 3 7 18
17Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 39: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/39.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
39
1 2 3 7 18
17Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 40: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/40.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
40
1 2 3 17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 41: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/41.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
41
1 2 3 17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 42: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/42.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
42
1 2 3
22
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 43: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/43.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
43
1 2 3
22
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 44: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/44.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
44
1 22 3
12
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 45: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/45.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
45
1 22 3
12
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 46: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/46.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
46
1 12 3
2
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 47: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/47.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
47
1 12 3
2
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 48: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/48.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
48
1 2 3
22
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 49: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/49.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
49
1 2 3
22
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 50: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/50.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
50
1 22 3
12
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 51: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/51.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
51
1 22 3
12
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 52: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/52.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
52
1 12 3
2
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 53: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/53.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
53
1 12 3
2
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 54: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/54.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
54
1 2 3
22
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 55: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/55.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
55
1 2 3
22
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 56: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/56.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
56
1 22 3
12
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 57: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/57.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
57
1 22 3
12
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 58: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/58.jpg)
Tiny Cache Example
❖ 2-way cache, 5 sets per page, showing 2 colors
❖ Eviction sets follow page offsets
58
1 12 3
2
17 18
27Cache
DRAM1 2 3 4 5
11 12 13 14 15
6 7 8 9 10
16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
Cache Set
![Page 59: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/59.jpg)
59
Big picture: cached page tables
Cache Set
Page
![Page 60: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/60.jpg)
Outline❖ Justification: ASLR
❖ Pagetable walks
❖ CPU Caches
❖ EVICT+TIME
❖ JavaScript
❖ Results
❖ Demo
60
![Page 61: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/61.jpg)
EVICT+TIME
❖ Flush TLB, forcing pagetable walk
❖ 2x to measure cached lookup time
❖ Flush TLB
❖ Evict first cacheline
❖ Measure possibly-uncached lookup time
❖ Find cacheline dependencies
61
![Page 62: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/62.jpg)
EVICT+TIME in Cache
62
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25 26 27 28 29 30
PTE 200: Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4 Level 3 Level 2 Level 1
PTE 300: Level 2 Phys Addr
PTE 400: Level 1 Phys Addr
PTE 500: Target Phys Addr
0x644b321f400011001000100101100110010000111110100000000000000
TLB
VAddr PAddr
![Page 63: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/63.jpg)
EVICT+TIME in Cache
63
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25 26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
![Page 64: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/64.jpg)
EVICT+TIME in Cache
64
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
![Page 65: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/65.jpg)
EVICT+TIME in Cache
65
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Do address lookup
![Page 66: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/66.jpg)
EVICT+TIME in Cache
66
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Do address lookup
![Page 67: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/67.jpg)
EVICT+TIME in Cache
67
24 Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ It was uncached - slow
![Page 68: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/68.jpg)
EVICT+TIME in Cache
68
24 Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Let’s do it again
![Page 69: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/69.jpg)
EVICT+TIME in Cache
69
24 Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ It was cached - fast
![Page 70: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/70.jpg)
EVICT+TIME in Cache
70
24 Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Let’s evict
![Page 71: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/71.jpg)
EVICT+TIME in Cache
71
24 Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Let’s evict
![Page 72: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/72.jpg)
EVICT+TIME in Cache
72
24 15 Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Let’s evict
![Page 73: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/73.jpg)
EVICT+TIME in Cache
73
24 15 Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Let’s evict
![Page 74: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/74.jpg)
EVICT+TIME in Cache
74
24 155
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Let’s evict
![Page 75: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/75.jpg)
EVICT+TIME in Cache
75
24 155
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Eviction done - let’s do lookup
![Page 76: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/76.jpg)
EVICT+TIME in Cache
76
24 155
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Eviction done - let’s do lookup
![Page 77: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/77.jpg)
EVICT+TIME in Cache
77
24 155
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Still cached
![Page 78: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/78.jpg)
EVICT+TIME in Cache
78
24 155
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Let’s evict
![Page 79: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/79.jpg)
EVICT+TIME in Cache
79
24 155
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Let’s evict
![Page 80: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/80.jpg)
EVICT+TIME in Cache
80
24 1514 5
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Let’s evict
![Page 81: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/81.jpg)
EVICT+TIME in Cache
81
24 1514 5
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Let’s evict
![Page 82: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/82.jpg)
EVICT+TIME in Cache
82
14 154 5
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Let’s evict
![Page 83: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/83.jpg)
EVICT+TIME in Cache
83
14 154 5
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Eviction done - let’s do lookup
![Page 84: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/84.jpg)
EVICT+TIME in Cache
84
14 154 5
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Eviction done - let’s do lookup
![Page 85: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/85.jpg)
EVICT+TIME in Cache
85
14 154 5
Cache
DRAM1 2 3 4 511 12 13 14 15
6 7 8 9 1016 17 18 19 20
21 22 23 24 25
26 27 28 29 30
PTE 200:Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4Level 3
Level 2Level 1
PTE 300:Level 2 Phys Addr
PTE 400:Level 1 Phys Addr
PTE 500:Target Phys Addr
0x644b321f4000
11001000100101100110010000111110100000000000000
TLB
VAddr
PAddr
Pagetable in DRAM
❖ Uncached now
![Page 86: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/86.jpg)
❖ 2 sources of ambiguity remaining
❖ Which are the 4 levels
❖ 8 slots per cacheline
❖ 4! *8*8*8*8=98304 (17 bits entropy)
❖ We have to vary the target
❖ This varies the slots
Ambiguity
86
PTE 200: Level 3 Phys Addr
CR3: Level 4 Physical Addr
Level 4 Level 3 Level 2 Level 1
PTE 300: Level 2 Phys Addr
PTE 400: Level 1 Phys Addr
PTE 500: Target Phys Addr
0x644b321f400011001000100101100110010000111110100000000000000
![Page 87: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/87.jpg)
Outline❖ Background: ASLR & Side Channels
❖ Pagetable walks
❖ CPU Caches
❖ EVICT+TIME
❖ JavaScript
❖ Results
❖ Demo
87
![Page 88: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/88.jpg)
JavaScript Complications
❖ A security boundary: sandbox
❖ There are some complications
❖ Instruction re-ordering
❖ Low resolution timer
❖ Contiguous virtual address space
88
❖ For code: a large block of JIT
❖ Return right away
❖ Don’t forget to flush the iTLB
Prototypes in Firefox and Chrome
![Page 89: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/89.jpg)
Outline❖ Background: ASLR & Side Channels
❖ Pagetable walks
❖ CPU Caches
❖ EVICT+TIME
❖ JavaScript
❖ Results
❖ Demo
89
![Page 90: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/90.jpg)
Results: speed
0 3 6 9
12 15 18 21 24 27 30 33 36
0 10 20 30 40 50
Rem
aini
ng v
irtua
l add
ress
ent
ropy
(bits
)
Elapsed time (s)
Chrome heap (PTL3 cacheline crossing)Firefox heap (PTL3 cacheline crossing)Firefox heap (PTL4 cacheline crossing)
Firefox JIT (PTL2 cacheline crossing)
90
![Page 91: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/91.jpg)
Results: tested microarchitectures
91
CPU Model Microarchitecture Year
Intel Xeon E3-1240 v5 Skylake 2015
Intel Core i7-6700K Skylake 2015
Intel Celeron N2840 Silvermont 2014
Intel Xeon E5-2658 v2 Ivy Bridge EP 2013
Intel Atom C2750 Silvermont 2013
Intel Core i7-4500U Haswell 2013
Intel Core i7-3632QM Ivy Bridge 2012
Intel Core i7-2620QM Sandy Bridge 2011
Intel Core i5 M480 Westmere 2010
Intel Core i7 920 Nehalem 2008
AMD FX-8350 8-Core Piledriver 2012
AMD FX-8320 8-Core Piledriver 2012
AMD FX-8120 8-Core Bulldozer 2011
AMD Athlon II 640 X4 K10 2010
AMD E-350 Bobcat 2010
AMD Phenom 9550 4-Core K10 2008
Allwinner A64 ARM Cortex A53 2016
Samsung Exynos 5800 ARM Cortex A15 2014
Samsung Exynos 5800 ARM Cortex A7 2014
Nvidia Tegra K1 CD580M-A1 ARM Cortex A15 2014
Nvidia Tegra K1 CD570M-A1 ARM Cortex A15; LPAE 2014
![Page 92: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/92.jpg)
Outline❖ Background: ASLR & Side Channels
❖ Pagetable walks
❖ CPU Caches
❖ EVICT+TIME
❖ JavaScript
❖ Results
❖ Demo
92
![Page 93: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/93.jpg)
93
![Page 94: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/94.jpg)
Reception
❖ Intel, AMD, ARM: CVE 2017-5925, 2017-5926, 2017-5927
❖ Chrome, Firefox, Safari, Edge: CVE-2017-5928
❖ Apple mitigation in iOS, Safari and tvOS updates
❖ Thank you NCSC-NL
94
![Page 95: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/95.jpg)
Conclusion❖ There is an micro-architectural MMU cache side channel
❖ Exploitable from JavaScript
❖ It breaks ASLR in sandboxed environments
❖ Project page: https://www.vusec.net/projects/anc/
❖ Native code: https://github.com/vusec/revanc
❖ Twitter @vu5ec
95
![Page 96: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/96.jpg)
Results: reliability
0 0.2 0.4 0.6 0.8
1
Chrome 3 Levels Firefox 3 Levels Firefox 4 Levels
False positiveFalse negative
Success rate
96
![Page 97: Kaveh Razavi MMU Magic in JavaScript: Erik Bosman ...powerofcommunity.net/poc2017/ben.pdfGet secrets by measuring out of the box Side effect outside the system e.g. Stethoscopes e.g](https://reader035.vdocuments.net/reader035/viewer/2022062909/5b19a8fe7f8b9a28258cc3e7/html5/thumbnails/97.jpg)
Results: noise❖ Repeat measurements vs confidence margin
97