Meltdown is a hardware vulnerability affecting most modern processors, including Intel, AMD, IBM POWER, and ARM processors. It allows a rogue process to read the kernel data in CPU L1-d cache, even when it is not authorized to do so. Until now, the only effective mitigation approach was to isolate kernel memory from user-mode processes. This solution has different names on different platforms: Kernel Page-Table Isolation (KPTI) on Linux, Kernel Virtual Address (KVA) Shadow on Windows, and Double Map (DM) on OS X.
In this talk, however, we will prove the illusion that the strong isolation of KPTI has perfectly defeated Meltdown to be incorrect. First, we propose Variant V3r to demonstrate that Meltdown can be improved to be more powerful and reliable than what people originally thought. Variant V3r significantly increases the reliability for a rogue process to read any kernel data (not necessary in L1-d cache) on multiple platforms. Next, we further propose an even more powerful attack, Variant V3z, that allows a rogue process to bypass KPTI/KVA/DM and reliably read any kernel data. To the best of our knowledge, V3z is the first Meltdown variant that is able to defeat KPTI/KVA/DM.
To demonstrate the reliability, efficiency, and effectiveness of these two new variants, we will show demos that unprivileged processes can reliably leak secrets from anywhere in the kernel space, even in the presence of KALSR.
Finally, we will offer suggestions to mitigate our proposed threats, and we call for more and more parties to join in this effort to improve the security of processors and operating systems.