KernelSnitch: Side-Channel Attacks on Kernel Data Structures

Publikation: Beitrag in Buch/Bericht/KonferenzbandBeitrag in einem KonferenzbandBegutachtung

Abstract

The sharing of hardware elements, such as caches, is known to introduce microarchitectural side-channel leakage. One approach to eliminate this leakage is to not share hardware elements across security domains. However, even under the assumption of leakage-free hardware, it is unclear whether other critical system components, like the operating system, introduce software-caused side-channel leakage.

In this paper, we present a novel generic software side-channel attack, KernelSnitch, targeting kernel data structures such as hash tables and trees. These structures are commonly used to store both kernel and user information, e.g., metadata for userspace locks. KernelSnitch exploits that these data structures are variable in size, ranging from an empty state to a theoretically arbitrary amount of elements. Accessing these structures requires a variable amount of time depending on the number of elements, i.e., the occupancy level. This variance constitutes a timing side channel, observable from user space by an unprivileged, isolated attacker. While the timing differences are very low compared to the syscall runtime, we demonstrate and evaluate methods to amplify these timing differences reliably. In three case studies, we show that KernelSnitch allows unprivileged and isolated attackers to leak sensitive information from the kernel and activities in other processes. First, we demonstrate covert channels with transmission rates up to 580 kbit/s. Second, we perform a kernel heap pointer leak in less than 65 s by exploiting the specific indexing that Linux is using in hash tables. Third, we demonstrate a website fingerprinting attack, achieving an F1 score of more than 89 %, showing that activity in other user programs can be observed using KernelSnitch. Finally, we discuss mitigations for our hardware-agnostic attacks.
Originalspracheenglisch
TitelNetwork and Distributed System Security Symposium (NDSS) 2025
DOIs
PublikationsstatusVeröffentlicht - 24 Feb. 2025
VeranstaltungNetwork and Distributed System Security Symposium 2025: NDSS 2025 - San Diego, USA / Vereinigte Staaten
Dauer: 23 Feb. 202528 Feb. 2025
https://www.ndss-symposium.org/ndss2025/

Konferenz

KonferenzNetwork and Distributed System Security Symposium 2025
KurztitelNDSS 2025
Land/GebietUSA / Vereinigte Staaten
OrtSan Diego
Zeitraum23/02/2528/02/25
Internetadresse

Fingerprint

Untersuchen Sie die Forschungsthemen von „KernelSnitch: Side-Channel Attacks on Kernel Data Structures“. Zusammen bilden sie einen einzigartigen Fingerprint.

Dieses zitieren