Remote Memory-Deduplication Attacks

Overview: Researchers Daniel Gruss and Erik Kraft from Graz University of Technology present the first practical remote memory deduplication side-channel attack executed entirely across the Internet. While operating systems and hypervisors previously disabled cross-domain deduplication, modern virtualization environments re-enabled page deduplication within individual security domains or virtual machines under the assumption that intra-domain sharing carries no threat. The authors overturn this assumption, demonstrating that a network adversary without local code execution can exploit standard web and network APIs to detect Copy-on-Write (CoW) page fault latency differences across 14 Internet hops, leaking memory contents and fingerprinting software.

Key Topics: - Operating system and hypervisor memory deduplication mechanisms (Kernel Samepage Merging / KSM) - The flawed intra-domain deduplication threat model in virtualized cloud environments - Exploiting network APIs to allocate page-aligned data and trigger in-place memory modifications - Overcoming Internet timing jitter, packet loss, and latency variations across 14 network hops - Constructing a remote memory oracle to fingerprint loaded libraries and disclose confidential data

Technical Details: Memory deduplication—such as Kernel Samepage Merging (KSM) in Linux or equivalent hypervisor mechanisms—scans physical RAM to identify pages with identical contents. When duplicates are detected, the kernel merges them into a single physical page, adjusts virtual page table mappings, and marks the page read-only with Copy-on-Write (CoW) semantics. Following initial local cross-VM deduplication attacks, vendors restricted deduplication to intra-domain boundaries, assuming that deduplication within a single customer domain or virtual machine posed no security hazard against external actors.

The authors demonstrate that this security boundary fails when systems host network-accessible services. To execute a remote deduplication attack, an attacker requires two fundamental primitives: the ability to upload attacker-controlled, page-aligned data that remains stored in the victim server memory, and an API endpoint that modifies that data in-place. The attacker transmits a candidate memory page corresponding to a specific target library or known secret. Once the server background scanner merges the attacker page with an identical page already present in the victim process memory, the page is marked CoW.

When the attacker subsequently submits an update request modifying the uploaded data, the server CPU triggers a Copy-on-Write page fault, requiring the operating system to allocate a new physical page and duplicate the memory contents. This CoW fault introduces a measurable execution latency (several microseconds locally). While skeptics assumed network jitter across the public Internet would drown out microsecond timing deltas, the researchers proved that repeated statistical sampling across 14 Internet hops successfully isolates the CoW signal. Testing against an Ubuntu virtual machine hosted on KVM, the authors reliably fingerprinted running software libraries and extracted secrets remotely.

Key Takeaways: Restricting memory deduplication to the same security domain or single virtual machine fails to mitigate side-channel risks, as remote network APIs can be weaponized as timing probes. Copy-on-Write microsecond timing anomalies are statistically detectable over wide-area networks despite Internet routing jitter and latency noise. Cloud providers and system administrators should completely disable memory deduplication mechanisms on hosts running network-exposed services handling sensitive or multi-tenant workloads.

(AI summary — Gemini Flash)