IEICE TRANSACTIONS on Fundamentals
Implementation of a Memory Disclosure Attack on Memory Deduplication of Virtual Machines
Summary :
Memory deduplication improves the utilization of physical memory by sharing identical blocks of data. Although memory deduplication is most effective when many virtual machines with same operating systems run on a CPU, cross-user memory deduplication is a covert channel and causes serious memory disclosure attack. It reveals the existence of an application or file on another virtual machine. The covert channel is a difference in write access time on deduplicated memory pages that are re-created by Copy-On-Write, but it has some interferences caused by execution environments. This paper indicates that the attack includes implementation issues caused by memory alignment, self-reflection between page cache and heap, and run-time modification (swap-out, anonymous pages, ASLR, preloading mechanism, and self-modification code). However, these problems are avoidable with some techniques. In our experience on KSM (kernel samepage merging) with the KVM virtual machine, the attack could detect the security level of attacked operating systems, find vulnerable applications, and confirm the status of attacked applications.
- Publication
- IEICE TRANSACTIONS on Fundamentals Vol.E96-A No.1 pp.215-224
- Publication Date
- 2013/01/01
- Publicized
- Online ISSN
- 1745-1337
- DOI
- 10.1587/transfun.E96.A.215
- Type of Manuscript
- Special Section PAPER (Special Section on Cryptography and Information Security)
- Category
- System Security
Authors
Keyword
Latest Issue
Copyrights notice of machine-translated contents
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Cite this
Copy
Kuniyasu SUZAKI, Kengo IIJIMA, Toshiki YAGI, Cyrille ARTHO, "Implementation of a Memory Disclosure Attack on Memory Deduplication of Virtual Machines" in IEICE TRANSACTIONS on Fundamentals,
vol. E96-A, no. 1, pp. 215-224, January 2013, doi: 10.1587/transfun.E96.A.215.
Abstract: Memory deduplication improves the utilization of physical memory by sharing identical blocks of data. Although memory deduplication is most effective when many virtual machines with same operating systems run on a CPU, cross-user memory deduplication is a covert channel and causes serious memory disclosure attack. It reveals the existence of an application or file on another virtual machine. The covert channel is a difference in write access time on deduplicated memory pages that are re-created by Copy-On-Write, but it has some interferences caused by execution environments. This paper indicates that the attack includes implementation issues caused by memory alignment, self-reflection between page cache and heap, and run-time modification (swap-out, anonymous pages, ASLR, preloading mechanism, and self-modification code). However, these problems are avoidable with some techniques. In our experience on KSM (kernel samepage merging) with the KVM virtual machine, the attack could detect the security level of attacked operating systems, find vulnerable applications, and confirm the status of attacked applications.
URL: https://global.ieice.org/en_transactions/fundamentals/10.1587/transfun.E96.A.215/_p
Copy
@ARTICLE{e96-a_1_215,
author={Kuniyasu SUZAKI, Kengo IIJIMA, Toshiki YAGI, Cyrille ARTHO, },
journal={IEICE TRANSACTIONS on Fundamentals},
title={Implementation of a Memory Disclosure Attack on Memory Deduplication of Virtual Machines},
year={2013},
volume={E96-A},
number={1},
pages={215-224},
abstract={Memory deduplication improves the utilization of physical memory by sharing identical blocks of data. Although memory deduplication is most effective when many virtual machines with same operating systems run on a CPU, cross-user memory deduplication is a covert channel and causes serious memory disclosure attack. It reveals the existence of an application or file on another virtual machine. The covert channel is a difference in write access time on deduplicated memory pages that are re-created by Copy-On-Write, but it has some interferences caused by execution environments. This paper indicates that the attack includes implementation issues caused by memory alignment, self-reflection between page cache and heap, and run-time modification (swap-out, anonymous pages, ASLR, preloading mechanism, and self-modification code). However, these problems are avoidable with some techniques. In our experience on KSM (kernel samepage merging) with the KVM virtual machine, the attack could detect the security level of attacked operating systems, find vulnerable applications, and confirm the status of attacked applications.},
keywords={},
doi={10.1587/transfun.E96.A.215},
ISSN={1745-1337},
month={January},}
Copy
TY - JOUR
TI - Implementation of a Memory Disclosure Attack on Memory Deduplication of Virtual Machines
T2 - IEICE TRANSACTIONS on Fundamentals
SP - 215
EP - 224
AU - Kuniyasu SUZAKI
AU - Kengo IIJIMA
AU - Toshiki YAGI
AU - Cyrille ARTHO
PY - 2013
DO - 10.1587/transfun.E96.A.215
JO - IEICE TRANSACTIONS on Fundamentals
SN - 1745-1337
VL - E96-A
IS - 1
JA - IEICE TRANSACTIONS on Fundamentals
Y1 - January 2013
AB - Memory deduplication improves the utilization of physical memory by sharing identical blocks of data. Although memory deduplication is most effective when many virtual machines with same operating systems run on a CPU, cross-user memory deduplication is a covert channel and causes serious memory disclosure attack. It reveals the existence of an application or file on another virtual machine. The covert channel is a difference in write access time on deduplicated memory pages that are re-created by Copy-On-Write, but it has some interferences caused by execution environments. This paper indicates that the attack includes implementation issues caused by memory alignment, self-reflection between page cache and heap, and run-time modification (swap-out, anonymous pages, ASLR, preloading mechanism, and self-modification code). However, these problems are avoidable with some techniques. In our experience on KSM (kernel samepage merging) with the KVM virtual machine, the attack could detect the security level of attacked operating systems, find vulnerable applications, and confirm the status of attacked applications.
ER -
English
