SysBumps：利用系统调用中的推测执行来破坏 macOS for Apple Silicon 中的 KASLR.pdf

1、#BHEU BlackHatEventsSysBumps:Exploiting Speculative Execution in System Calls for Breaking KASLR in macOS for Apple SiliconSpeaker:Hyerean Jang$WhoamiHyerean JangPh.D Student Korea University Email:hr_jangkorea.ac.kr Research interests:Microarchitectural side-channel vulnerability,System security Co

2、ntributorsTaehun KimPh.D Student Korea University Email:taehunkkorea.ac.krYoungjoo ShinProfessor Korea University Email:syoungjookorea.ac.krApple SiliconApples proprietary arm-based processorApple SiliconApples proprietary arm-based processorExploring Microarchitectural Side-Channel Vulnerabilities

3、on macOS for Apple SiliconmacOSWhat is SysBumps Attack?KASLR breaking attack on macOS for Apple siliconWhat is SysBumps Attack?KASLR breaking attack on macOS for Apple siliconSpeculativeExecutionIn system callWhat is SysBumps Attack?KASLR breaking attack on macOS for Apple siliconSpeculativeExecutio

4、nTLB-basedSide-channelIn system callOutline Background Existing Microarchitectural Attack on KASLR Challenges Our Approaches SysBumps Attack Mitigations TakeawayMicroarchitectural Side-Channel Attack Exploit CPU design flaws to extract information through indirect leakages-Cache,TLB,branch predictor

5、s,Kernel Address Space Layout Randomization Load kernel into random location-Prevent attackers from predicting target kernel addresses for exploitsKernelKernelKernelNext bootingNext bootingKernel Address Space Layout Randomization Kernel is loaded within a reserved range of kernel addresses-Aligned

6、address to a specific sizeKernel address rangeAligned addressKernelKernel Address Space Layout Randomization Kernel is loaded within a reserved range of kernel addresses-Aligned address to a specific size Linux :0 xFFFFFFFF 8000 0000 0 xFFFF FFFF C000 0000(16MB aligned)Windows:0 xFFFF F800 0000 0000