Paper 2014/970

Jackpot Stealing Information From Large Caches via Huge Pages

Gorka Irazoqui, Thomas Eisenbarth, and Berk Sunar


The cloud computing infrastructure relies on virtualized servers that provide isolation across guest OS's through sandboxing. This isolation was demonstrated to be imperfect in past work which exploited hardware level information leakages to gain access to sensitive information across co-located virtual machines (VMs). In response virtualization companies and cloud services providers have disabled features such as deduplication to prevent such attacks. In this work, we introduce a fine-grain cross-core cache attack that exploits access time variations on the last level cache. The attack exploits huge pages to work across VM boundaries without requiring deduplication. No configuration changes on the victim OS are needed, making the attack quite viable. Furthermore, only machine co-location is required, while the target and victim OS can still reside on different cores of the machine. Our new attack is a variation of the prime and probe cache attack whose applicability at the time is limited to L1 cache. In contrast, our attack works in the spirit of the flush and reload attack targeting the shared L3 cache instead. Indeed, by adjusting the huge page size our attack can be customized to work virtually at any cache level/size. We demonstrate the viability of the attack by targeting an OpenSSL1.0.1f implementation of AES. The attack recovers AES keys in the cross-VM setting on Xen 4.1 with deduplication disabled, being only slightly less efficient than the flush and reload attack. Given that huge pages are a standard feature enabled in the memory management unit of OS's and that besides co-location no additional assumptions are needed, the attack we present poses a significant risk to existing cloud servers.

Available format(s)
Publication info
Preprint. MINOR revision.
Cross-VMhuge pagesmemory deduplicationprime and probeflush+reloadcache attacks.
Contact author(s)
girazoki @ wpi edu
2014-12-16: last of 2 revisions
2014-11-28: received
See all versions
Short URL
Creative Commons Attribution


      author = {Gorka Irazoqui and Thomas Eisenbarth and Berk Sunar},
      title = {Jackpot Stealing Information From Large Caches via Huge Pages},
      howpublished = {Cryptology ePrint Archive, Paper 2014/970},
      year = {2014},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.