Advanced Exploit Techniques using Side-Channel Attacks = 사이드 채널 공격을 활용한새로운 익스플로잇 기법

국문 초록 (Abstract)

다양한커널미티게이션의등장으로익스플로잇테크닉은점점더복잡해지고있
다. 본논문은사이드채널공격을응용하여 새로운익스플로잇방법을개발하는 데
초점을둔다.
첫째, 우리는 기존의brute-force 방식으로재현이어려운구조적특성을가진
특정레이스컨디션유형을발견하였다. 이러한문제를 해결하기 위해우리는 성능
저하공격을활용해race window를 넓히는 EXPRACE (Security 2021)를 제안하였다.
EXPRACE 는 유저가간접적으로발생시킬 수있는 총네가지인터럽트를 발견하였
으며, 기존에 재현할수없었던레이스컨디션을성공적으로재현하였다.
둘째, 우리는 커널힙 익스플로잇의낮은성공률이힙의구조적복잡성에서기
인함을확인하였다. 이를 극복하기 위해우리는 타이밍사이드채널을통해간접적
으로힙 상태를 식별하는 PSPRAY (Security 2023)를 제안하였다. PSPRAY 는 오브
젝트를 할당할때사용가능한페이지가없으면 새로운페이지가할당된다는 점을
활용하여 slab freelist randomization과같은커널힙 미티게이션을효과적으로우회
할수있음을증명하였다.
마지막으로, 오늘날 공격시나리오에서흔히 활용되는 브라우저와컨테이너환
경에서는 커널미티게이션정보가숨겨져있어 익스플로잇의난이도가높아지고
있다. 이러한문제를 해결하고자우리는 미티게이션의특성을분석하여 cache side-
channel attack과timing side-channel attack을통해미티게이션정보를 추론하는 새
로운fingerprinting 방법론(SP 2026 제출)을소개한다.

다국어 초록 (Multilingual Abstract)

The emergence of various kernel mitigations has increasingly complicated exploitation
techniques. This paper focuses on developing novel exploitation methods by leveraging
side-channel attacks.
First, we identified a specific type of race condition structurally resistant to repro-
duction through traditional brute-force attacks. To address this challenge, we proposed
EXPRACE, which leverages a performance degradation attack to widen the race window
(Security 2021). EXPRACE identified a total of four interrupts that users can indirectly
trigger and successfully reproduced previously unreproducible race conditions.
Second, we identified the low success rate of kernel heap exploits stems from
structural complexities. To overcome this, we proposed PSPRAY (Security 2023), which
indirectly reveals heap status via a timing side-channel. PSPRAY demonstrated it can
bypass kernel heap mitigations, such as slab freelist randomization, by leveraging the
observation that if no pages are available when allocating an object, a new page is
allocated.
Lastly, modern attack scenarios commonly involve browser and container environ-
ments, which obscure kernel mitigation information, complicating exploitation efforts.
To address this, we introduce a novel fingerprinting methodology (submitted to SP
2026) designed to uncover kernel mitigation details in such contexts. By analyzing
characteristics of mitigations, our methodology leverages tailored cache side-channel
attacks and timing side-channel attacks to accurately infer mitigation statuses.

목차 (Table of Contents)

• 1 EXPRACE: Exploiting Kernel Races through Raising Interrupts 1
• 1.1 Introduction 1
• 1.2 Exploitability of Kernel Data Races 5
• 1.2.1 Single-Variable Race 6
• 1.2.2 Multi-Variable Race 7
• 1.3 Problem Scope and Research Approaches 11
• 1.3.1 Problem Scope 11
• 1.3.2 Research Approaches 12
• 1.4 Interrupt Handling in Linux 14
• 1.5 Exploiting Kernel Races in Linux 15
• 1.5.1 Reschedule IPI 16
• 1.5.2 Non-Reschedule IPI 18
• 1.5.3 Hardware Interrupts 22
• 1.6 Exploiting Kernel Races in Other OSes 24
• 1.6.1 Microsoft Windows 25
• 1.6.2 Mac OS X 26
• 1.7 Evaluation 26
• 1.7.1 Exploiting Real-World Races in Linux 27
• 1.7.2 Exploiting Synthetic Races in Linux 29
• 1.7.3 Exploiting Other OSes 34
• 1.8 Discussion 35
• 1.8.1 Possibility of Exploiting Other OSes 35
• 1.8.2 Mitigation 35
• 1.9 Related work 36
• 1.10 Conclusion 38
• 2 PSPRAY: Timing Side-Channel based Linux Kernel Heap Exploitation Technique 39
• 2.1 Introduction 39
• 2.2 Background 43
• 2.2.1 SLUB Allocator 43
• 2.2.2 Slab Freelist Random 44
• 2.3 Exploitation method and failure cases 45
• 2.3.1 Out-Of-Bounds 45
• 2.3.2 Use-After-Free and Double-Free 48
• 2.4 Our Approach : PSPRAY 51
• 2.4.1 Timing Side-Channel on SLUB allocator 52
• 2.4.2 Inferring Allocation Status 53
• 2.4.3 Proof-Of-Concept 54
• 2.5 Application of PSPRAY 55
• 2.5.1 OOB Exploitation 55
• 2.5.2 UAF and DF Exploitation 57
• 2.6 Attack Evaluation 58
• 2.6.1 Synthetic Vulnerability 58
• 2.6.2 Real-World Vulnerability 61
• 2.7 Mitigation 64
• 2.8 Discussion 69
• 2.8.1 The Noise 69
• 2.8.2 The other OSes 70
• 2.9 Related work 71
• 2.10 Conclusion 72
• 3 Fingerprinting Kernel Mitigations using Side-Channel Attacks 73
• 3.1 Introduction 73
• 3.2 Side-Channel Attack 77
• 3.2.1 Cache Side-Channel 77
• 3.2.2 Timing Side-Channel 78
• 3.3 Motivation and Threat Model 79
• 3.3.1 Motivation 79
• 3.3.2 Threat model 80
• 3.4 Deep Analysis of Kernel Mitigations 80
• 3.4.1 CONFIG_CFI_CLANG 80
• 3.4.2 CONFIG_SLAB_FREELIST_RANDOM 82
• 3.4.3 CONFIG_MEMCG_KMEM 83
• 3.4.4 CONFIG_SLAB_BUCKET 84
• 3.4.5 CONFIG_RANDOM_KMALLOC_CACHES 85
• 3.5 Fingerprinting Kernel Mitigation 86
• 3.5.1 Cache Side-Channel 87
• 3.5.2 Timing Side-Channel 91
• 3.6 Evaluation 97
• 3.6.1 Synthetic Environment 97
• 3.6.2 Real-World Environment 102
• 3.6.3 Other Architectures 104
• 3.7 Discussion 105
• 3.7.1 Cache Side-Channel in Other Architectures 106
• 3.7.2 Future Work 107
• 3.8 Related work 108
• 3.8.1 Side-Channel Attack 108
• 3.8.2 Kernel Mitigations 109
• 3.9 Conclusion 110
• A EXPRACE 130
• B PSPRAY 134
• B.1 Heavy workload test with stress-ng134
• B.2 Success rate according to the number of dummy objects 135
• B.3 Performance Overhead of Mitigation 135
• B.3.1 After system booting 136
• B.3.2 LMBench 137
• B.3.3 SPEC CPU2017 137
• C Fingerprinting Kernel Mitigations 145
• C.1 Techniques for Enhancing Accuracy 145
• C.2 Experimental Setup 146