摘要： 针对开启内核地址空间布局随机化（KASLR）防护的Linux系统，提出一种基于CPU预取指令的Cache计时攻击方法。Intel CPU的预取指令在预取未映射到物理地址的数据时会发生Cache失效，导致消耗的CPU时钟周期比已映射到物理地址的数据要长。根据这一特点，通过rdtscp指令获取CPU时钟周期消耗，利用计时攻击绕过KASLR技术防护，从而准确获取内核地址映射的Offset。实验结果表明，该攻击方法能够绕过Linux操作系统的KASLR防护，获得准确的内核地址映射位置，并且避免引起大量Cache失效。

关键词: 内核地址空间布局随机化, 预取指令, 计时攻击, 内核, Cache失效

Abstract: For Linux systems with Kernel Address Space Layout Randomization(KASLR) protection, this paper proposes a Cache instant attack method based on CPU prefetch instruction. When the prefetch instructions of Intel CPU prefetch data that is not mapped to physical address, a Cache failure will occur, resulting in the consumption of CPU clock cycles longer than the data mapped to physical address. According to this feature, the CPU clock cycle consumption is obtained by using the rdtscp instruction, and the protection of KASLR technology is bypassed by using timing attacks, so as to accurately obtain the Offset of kernel address mapping. Experimental results show that this attack method can bypass the KASLR protection of Linux operating system to obtain the accurate mapping location of kernel address, and avoid causing a large number of Cache failures.

Key words: Kernel Address Space Layout Randomization (KASLR), prefetch instruction, timing attack, kernel, Cache miss

中图分类号: 

• TP309.7