⬇ Download holy card: ·
Saint EntryBleed, Who Gave Away the Kernel's Map
Patron of KASLR, Page Table Isolation, and anyone hoping some address stays secret.
Life
On 16 December 2022 William Liu published EntryBleed: to allow the switch between user space and kernel, Page Table Isolation left a few entry pages mapped. By measuring prefetch timing, based on TLB behaviour on Intel CPUs, a local attacker could de-randomise the kernel base in about a second, defeating KASLR's protection on bare metal and in VMs.
Prayer
O Saint EntryBleed, who reads the map in access times, let our addresses stay hidden even from the stopwatch. Amen.
How to celebrate
Celebrated by applying the kernel mitigations and remembering that KASLR alone is not enough.
A fast address is a secret half-cooked.