Cache_attacks

1.

Cache attacks
Brief Overview
2021-10-13 ⦁ Romain Malmain
1

2.

What is a CPU cache ?
CPU
core
≈ 5 ns
Cache
≈ 100 ns
≈ 100 ns
RAM
Problem :
● Access to RAM is very
costly (Read/Write access)
Observation :
● Most of the time we access
a very small part of the
code / data base
Idea :
● Store somewhere recently
accessed code / data
Solution :
● “somewhere” is the cache :
It’s a fast and small
memory (~256KB) between
the RAM and the registers

3.

Caches on ARM Cortex-A CPUs
core 0
core 1
core 2
core 3
L1
L1
L1
L1
L2
last-level cache (L2) on Android:
● shared
● but not inclusive
= eviction in L2 doesn’t
imply eviction in L1

4.

Cache Architecture
Index
Set 0
Cache line
Cache line
Cache line
Cache line
Cache line
offset
Set 1
tag
value
value
...
value
Structure of an address
tag
index
offset
0xFFFFFFFF__AAAAAA__BBB
Set 255
Cache line
Cache line
Way 0
Way 1
4

5.

How can we exploit this ?
5

6.

Evict+Time
Victim address
space
Attacker address
space
Cache
fast access
loads datas
slow access
Step 0: The victim is executed (at least twice) and timed
Step 1: The attacker evicts one specific cache set (evict)
Step 2: The victim is executed once again and timed (time)
6

7.

Prime+Probe
Attacker
address space
Victim
address space
Cache
fast access
loads data
slow access
loads data
Step 0: attacker fills the cache (prime)
Step 1: victim evicts cache lines while performing operations
Step 2: attacker probes data to determine if the set was accessed
7

8.

Flush + Reload
Attacker address
space
Victim address
space
Cache
loads data
loads data
fast access
Step 0: The attacker loads a shared object
Step 1: The attacker flushes a cache line from the shared object from the cache
Step 2: The victim programs runs
Step 3: The attacker checks if the corresponding cache line has been loaded by the victim
8

9.

Does it work in real life ?
YES
Example :
Detect swipe / tap on an Android device from a user application
(Flush + Reload attack)
TAP
SWIPE
TAP
9

10.

Conclusion
Side channel attacks are hard to handle but must
be considered when designing a system.
Thanks for your attention !
Romain Malmain ⦁ romain.malmain@pm.me
10