Jump over ASLR: Attacking branch predictors to bypass ASLR
By Dmitry Evtyushkin, Dmitry V. Ponomarev, Nael B. Abu-Ghazaleh. Micro, 2016
299 citations recorded by the source corpus.
Subfields: Artificial Intelligence, Materials Chemistry, Signal Processing
View Paper: https://www.semanticscholar.org/paper/fe063c1f4affdabfcda1151770be92114949d669
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Daniel Gruss
- Michael Schwarz
- Jo Van Bulck
- Moritz Lipp
- Yuval Yarom
- Stefan Mangard
- Frank Piessens
- Daniel Genkin
In Materials Chemistry
In Signal Processing
- Daniel Gruss
- Michael Schwarz
- Stefan Mangard
- Moritz Lipp
- Yuval Yarom
- Jo Van Bulck
- Herbert Bos
- Cristiano Giuffrida
Citations in the corpus
- Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing (2016, methodology): “Several researchers have tried to use this side channel to infer cryptographic keys [3], create a covert channel [12], and break address space layout randomization (ASLR) [13].”
- BranchScope: A New Side-Channel Attack on Directional Branch Predictor (2018, methodology): “In other work [21], we recently proposed a side-channel attack on the BTB that creates BTB collisions between the victim and the attacker processes, thus allowing the attacker to discover the location of a particular victim’s branch instruction in the address space, bypassing address space layout ra”
- A survey of microarchitectural timing attacks and countermeasures on contemporary hardware (2016, background): “Evtyushkin et al. [52] implemented a side-channel attack on BTB collisions, which can find both kernel-level and user-level virtual address space layout on ASLR enabled Linux platforms.”
- Spectre Attacks: Exploiting Speculative Execution (2018, methodology): “It finds the hypervisor ASLR location by analyzing branch history buffer and branch target buffer leaks [14, 72].”
- A Systematic Evaluation of Transient Execution Attacks and Defenses (2018, background): “, the Branch History Buffer (BHB) [11], the Branch Target Buffer (BTB) [54, 18], the Pattern History Table (PHT) [20], and the Return Stack Buffer (RSB) [20].”
- Translation Leak-aside Buffer: Defeating Cache Side-channel Protections with TLB Attacks (2018, background): “Previously, branch prediction has been attacked to leak data or ASLR information [2, 3, 14, 35].”