2018

Meltdown

Lipp, Moritz, Schwarz, Michael, Gruss, Daniel et al.

Understand

The security of computer systems fundamentally relies on memory isolation, e.g., kernel address ranges are marked as non-accessible and are protected from user access.

In this paper, we present Meltdown.
Meltdown exploits side effects of out-of-order execution on modern processors to read arbitrary kernel-memory locations including personal data and passwords.
Out-of-order execution is an indispensable performance feature and present in a wide range of modern processors.

Built on

An efficient algorithm for exploiting multiple arithmetic units
1967
Earlier work this paper cites.
Two-level adaptive training branch prediction
1991
Earlier work this paper cites.
Timing Attacks on Implementations of Diffe-Hellman, RSA, DSS, and Other Systems
1996
Earlier work this paper cites.
Towards a high performance neural branch predictor
1999
Earlier work this paper cites.
The schemes and performances of dynamic branch predictors
2000
Earlier work this paper cites.
Dynamic branch prediction with perceptrons
2001
Earlier work this paper cites.
Cache missing for fun and profit
2005
Earlier work this paper cites.
Cache Attacks and Countermeasures: the Case of AES
2006
Earlier work this paper cites.
Computer architecture: a quantitative approach
2011
Earlier work this paper cites.
Mac OS X and IOS Internals: To the Apple’s Core
2012
Earlier work this paper cites.
Kernel address space layout randomization, 2013
2013
Earlier work this paper cites.
Practical Timing Side Channel Attacks against Kernel Space ASLR
2013
Earlier work this paper cites.

Similar

“Ooh Aah… Just a Little Bit”
2014
Cited alongside, same era.
Wait a minute! A fast, Cross-VM attack on AES
2014
Cited alongside, same era.
Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack
2014
Cited alongside, same era.
Cross-Tenant Side-Channel Attacks in PaaS Clouds
2014
Cited alongside, same era.
Cache Template Attacks: Automating Attacks on Inclusive Last-Level Caches
2015
Cited alongside, same era.
Last-Level Cache Side-Channel Attacks are Practical
2015
Cited alongside, same era.
AMD Takes Computing to a New Horizon with Ryzen™Processors, 2016
2016
Cited alongside, same era.
Prefetch Side-Channel Attacks: Bypassing SMAP and Kernel ASLR
2016
Cited alongside, same era.
Flush+Flush: A Fast and Stealthy Cache Attack
2016
Cited alongside, same era.
Breaking Kernel Address Space Layout Randomization with Intel TSX
2016
Cited alongside, same era.
ARMageddon: Cache Attacks on Mobile Devices
2016
Cited alongside, same era.
Spectre Attacks: Exploiting Speculative Execution
Cited in the paper.

Then

Perceptron learning for reuse prediction
2016
Later among the works it cites.
Negative Result: Reading Kernel Memory From User Mode, 2017
2017
Later among the works it cites.
ASLR on the Line: Practical Cache Attacks on the MMU
2017
Later among the works it cites.
Strong and Efficient Cache Side-Channel Protection using Hardware Transactional Memory
2017
Later among the works it cites.
KASLR is Dead: Long Live KASLR
2017
Later among the works it cites.
Windows 17035 Kernel ASLR/VA Isolation In Practice (like Linux KAISER)., 2017
2017
Later among the works it cites.
The current state of kernel page-table isolation, Dec. 2017
2017
Later among the works it cites.
Hello from the Other Side: SSH over Robust Cache Covert Channels in the Cloud
2017
Later among the works it cites.
x86: Enable KASLR by default, 2017
2017
Later among the works it cites.
Linux 4.12 To Enable KASLR By Default, 2017
2017
Later among the works it cites.
KeyDrown: Eliminating Software-Based Keystroke Timing Side-Channel Attacks
2018
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…