Breaking KASLR Using Memory Deduplication in Virtualized Environments

Recent operating systems (OSs) have adopted a defense mechanism called kernel page table isolation (KPTI) for protecting the from all attacks that break address space layout randomization (KASLR) using various side-channel analysis techniques. In this paper, we demonstrate KASLR can still be broken, even with latest OSs where KPTI is applied. particular, present novel memory-sharing-based attack breaks on KPTI-enabled Linux virtual machines. The proposed leverages memory deduplication feature hypervisor, which provides timing channel inferring secret information regarding victim. By conducting experiments KVM and VMware ESXi, show obtain within short amount of time. We also several countermeasures prevent such an attack.