Solutions to the AnC exploit, which defeats ASLR

[FReic]

Hi all,

A little while ago some researchers devised an exploit called AnC, which is described here:

https://www.vusec.net/projects/anc/ https://www.vusec.net/projects/anc/

The researchers discovered that they can figure out which 4kB pages are

in use at any time, because unfortunately Intel, AMD and ARM processors allow Page Table Entries

to be cached, providing a linkage between user processes and the virtual memory system.

Using a clever technique they can perform a walk of the page tables even using a

Javascript program.

It's a fascinating attack. Here are my questions about how to defeat AnC:

1. Can Intel microcode be updated in deployed systems to prevent PTEs

from ever being cached in the data & instruction caches?

2. If the kernel were to create decoy pages e.g. 10 for every 1 "real" page,

would that not cut down attacks sufficiently in most cases?

3. Is cache partitioning (Cache allocation technology) a solution to AnC,

as the researchers believe and do common Core CPUs offer it, or is it

just a Xeon feature?

Thanks.

[idata]

Hello frankr,

Please let me review your inquiry, I will keep you posted as soon as possible.

Regards,

Amy.

[Ronny_G_Intel]

Hi frankr,

I work for Intel Customer Support and I was looking at this very old post and I see that this is set up to "Assumed Answered" so I hope you got the information that you were looking for.

Unfortunately, all details about this are confidential and cannot be disclosed but please let me know if you are having a real issue related to it.

Thanks,

Ronny G