New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 806725 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Chrome , Mac
Pri: 1
Type: Task



Sign in to add a comment

Security: Investigate disabling Transparent Huge Pages to make CPU-cache based timing attacks harder

Project Member Reported by verwa...@chromium.org, Jan 29 2018

Issue description

Transparent huge pages make it easy to use the last-level CPU cache (L3) for cache timing: by mapping contiguous virtual addresses to contiguous physical addresses JS apps gain close control over physical addresses in multi-megabyte ranges. This allows an attacker to amplify cache timing to 100s of microseconds or even likely even milliseconds.

By using 4kb pages instead of huge pages (2mb or larger), it's much harder to discover congruent pages that add up to megabytes of physical memory that can be controlled to fill specific L3 cache slices.

We should look into using 4kb pages to make this kind of attack more difficult.
 

Comment 1 by palmer@chromium.org, Jan 30 2018

Components: Security Internals Blink>MemoryAllocator>Partition
Labels: -Type-Bug-Security M-65 OS-Android OS-Chrome OS-Linux Pri-1 Type-Task
Cc: erikc...@chromium.org wfh@chromium.org
Labels: OS-Mac
On Linux and Chrome OS, I get:

$ cat /sys/kernel/mm/transparent_hugepage/enabled
always [madvise] never

According to https://linux.die.net/man/2/madvise:

"""
MADV_HUGEPAGE (since Linux 2.6.38)
Enables Transparent Huge Pages (THP) for pages in the range specified by addr and length. Currently, Transparent Huge Pages only work with private anonymous pages (see mmap(2)). The kernel will regularly scan the areas marked as huge page candidates to replace them with huge pages. The kernel will also allocate huge pages directly when the region is naturally aligned to the huge page size (see posix_memalign(2)).
"""

I think that's the `always` behavior; when the setting is `madvise`, you only get hugepages with `madvise(address, size, MADV_HUGEPAGE)`.

So it seems that we have already turned off hugepages on Linux and Chrome OS. We call madvise with `MADV_HUGEPAGE` in only 1 place (chromeos/hugepage_text/hugepage_text.cc).

On Android, /sys/kernel/mm/transparent_hugepage/enabled seems not to exist. What that means for hugepages, I don't yet know.

Toon says: "On the other hand, I get a clear cache timing signal on OSX with a configuration that should only work if typed arrays aligned on physical pages... so at least on some operating systems that's the default behavior?" macOS has `VM_FLAGS_SUPERPAGE_SIZE_*` (https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man2/mmap.2.html) for what looks like equivalent behavior. But it may be on by default, unlike our Linuxes? +erikchen who might know. We never explicitly use `VM_FLAGS_SUPERPAGE_SIZE_*`.

+wfh: Do you know of an equivalent behavior on Windows?
Chrome is not allocating superpages on macOS. It is also not intentionally allocating contiguous physical memory. 

Observations:
1) Trying to allocate superpages is very hard on a long-running instance of macOS. I actually couldn't get a test program to do this without restarting the machine [the kernel couldn't get a 2MB contiguous region]

2) After a restart, there were no issues. The share_mode of the memory region is SM_LARGEPAGE, which vmmap reports as "SM=". Using vmmap on Chrome processes reveals no VM_ALLOCATE regions with "SM="

3) Looking at the source itself, the only way to allocate superpages is with mmap or vm_allocate w/ appropriate flags. Chrome does not do this.

4) In the kernel, the function responsible for allocating contiguous physical memory is cpm_allocate(). There are a small number of consumers of this function, but those don't appear to be called by Chrome.

5) But it's possible that the pages are contiguous for less obvious reasons. Two possibilities:
  5a) physical pages get placed in some queue contiguously. When we mmap a large reason and start touching the pages, the kernel just starts dequeuing pages contiguously, thus resulting in a contiguous region.
  5b) The implementation of page-faulting is being clever and intentionally makes the physical pages contiguous. 

I went through the faulting implementation vm_fault_enter() and didn't see any clever logic. We should be able to verify (5a). Write a program that uses vmmap to allocate all the physical memory in small chunks. Then release them in a random order. Then see if the cache timing signal still works.

Comment 4 by palmer@chromium.org, Mar 19 2018

Status: Fixed (was: Assigned)
I think there is nothing more to do here.
Project Member

Comment 5 by sheriffbot@chromium.org, Mar 20 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 6 by sheriffbot@chromium.org, Jun 26 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment