Skip to main content
CSIRO Logo Data 61 logo

Meltdown: reading kernel memory from user space

Authors

Moritz Lipp, Michael Schwartz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom and Mike Hamburg

Google

DATA61

Independent

Graz University of Technology

Rambus

Cyberus Technology

G DATA Advanced Analytics

University of Pennsylvania & University of Maryland

The University of Adelaide

Abstract

The security of computer systems fundamentally relies on memory isolation, e.g., kernel address ranges are marked as non-accessible and are protected from user access. In this paper, we present Meltdown. Meltdown exploits side effects of out-of-order execution on modern processors to read arbitrary kernel-memory locations including personal data and passwords. Out-of-order execution is an indispensable performance feature and present in a wide range of modern processors. The attack is independent of the operating system, and it does not rely on any software vulnerabilities. Meltdown breaks all security guarantees provided by address space isolation as well as paravirtualized environments and, thus, every security mechanism building upon this foundation. On affected systems, Meltdown enables an adversary to read memory of other processes or virtual machines in the cloud without any permissions or privileges, affecting millions of customers and virtually every user of a personal computer. We show that the KAISER defense mechanism for KASLR has the important (but inadvertent) side effect of impeding Meltdown. We stress that KAISER must be deployed immediately to prevent large-scale exploitation of this severe information leakage.

BibTeX Entry

  @inproceedings{Lipp_SGPHFHMKGYH_18,
    year             = {2018},
    month            = aug,
    pages            = {-},
    publisher        = {USENIX},
    paperurl         = {https://ts.data61.csiro.au/publications/csiro_full_text/Lipp_SGPHFHMKGYH_18.pdf},
    booktitle        = {USENIX Security Symposium},
    author           = {Lipp, Moritz and Schwartz, Michael and Gruss, Daniel and Prescher, Thomas and Haas, Werner and Fogh,
                        Anders and Horn, Jann and Mangard, Stefan and Kocher, Paul and Genkin, Daniel and Yarom, Yuval and
                        Hamburg, Mike},
    address          = {Baltimore, MD, USA},
    title            = {Meltdown: Reading Kernel Memory from User Space},
    date             = {2018-8-15}
  }

Download