Paper Info
Title
Implementation Of A Memory Disclosure Attack On Memory Deduplication Of Virtual Machines
Abstract
Memory deduplication improves the utilization of physical memory by sharing identical blocks of data. Although memory deduplication is most effective when many virtual machines with same operating systems run on a CPU, cross-user memory deduplication is a covert channel and causes serious memory disclosure attack. It reveals the existence of an application or file on another virtual machine. The covert channel is a difference in write access time on deduplicated memory pages that are re-created by Copy-On-Write, but it has some interferences caused by execution environments. This paper indicates that the attack includes implementation issues caused by memory alignment, self-reflection between page cache and heap, and run-time modification (swap-out, anonymous pages, ASLR, preloading mechanism, and self-modification code). However, these problems are avoidable with some techniques. In our experience on KSM (kernel samepage merging) with the KVM virtual machine, the attack could detect the security level of attacked operating systems, find vulnerable applications, and confirm the status of attacked applications.
Year
DOI
Venue
2013
10.1587/transfun.E96.A.215
IEICE TRANSACTIONS ON FUNDAMENTALS OF ELECTRONICS COMMUNICATIONS AND COMPUTER SCIENCES
Keywords
Field
DocType
memory disclosure attack, virtual machine, memory deduplication
Interleaved memory,Uniform memory access,Computer security,Computer science,Virtual memory,Theoretical computer science,Data diffusion machine,Memory management,Memory map,Flat memory model,Operating system,Demand paging
Journal
Volume
Issue
ISSN
E96A
1
0916-8508
Citations 
PageRank 
References 
6
0.50
11
Authors
4
Name
Order
Citations
PageRank
Kuniyasu Suzaki112713.85
Kengo Iijima2705.81
Toshiki Yagi3696.21
Cyrille Artho458844.46