Dutch security researchers have found a way to bypass hardware-level security measures that stop attackers from manipulating and leaking data in computer memory, making for a browser-based vulnerability that is hard to protect against.
The low-level attack devised by the researchers at the Free University of Amsterdam (VU) focuses on the memory management unit (MMU) in modern processors.
This handles all the virtual memory management and cache control, and is an integral part of all modern hardware to speed up processor performance.
If an attacker can work out where data is arranged in a computer's memory, it is relatively easy to successfully exploit the system. Address space layout randomisation (ASLR) is a hardware feature that locates application code and data in arbitrary memory addresses, making it harder for attackers to work out where it is.
By exploiting how the MMU uses the caches or short-term fast storage areas in processors, and how they are ordered, the researchers were able to time page table walks during memory access and eventually bypass ASLR protection.
The researchers' ASLR+Cache (AnC) attack enabled them to work out which cache lines are associated with certain memory pages, and from there, to find code and heap pointers.
The attack works on processors from Intel, AMD, Allwinner, Samsung, and Nvidia, the researchers said.
"There was no [processor] architecture that we tried without observing the MMU signal," they noted.
Attacks against Google's Chrome and Mozilla Foundation's Firefox could be performed in just over ten seconds.
The VU researchers said there's no way to protect against the attack, as the vulnerability is part and parcel of modern computer processors. Processor, browser, and operating system vendors were notified by the VU researchers last October.