AnC Attacks Render ASLR Useless

The mechanism is vulnerable in at least 22 processor micro-architectures from vendors such as Intel, AMD, ARM and Nvidia. Successful exploitation of this flaw could lead to an increase in the impact of drive-by exploits.

The AnC attack focuses on the memory management unit, which is used to keep track of memory allocation. The AnC with a remote code execution attack targets the memory areas that can achieve a successful exploit leading to a compromised device.

The attack is a JavaScript payload which hosts on a malicious site. An exploit kit landing page allows a range of flaws that would have otherwise been mitigated by ASLR’s protection. This can cause a remote crash or the data that is held within memory to be lost. With the additional AnC knowledge of the correct memory locations, this can result in a full and reliable remote code execution exploit leading to malware delivery and complete control of the target machine.

Vulnerabilities have been found in the past that have targeted the cache from within the browser. For many of the mainstream browser vendors, the answer has been to break the performance.now() time function. The work on this vulnerability included the use of new timers being created within JavaScript not only allowing the AnC attack to work but also potentially bringing back to life vulnerabilities that were thought to have been mitigated.

For further information:

CVEs

• CVE-2017-5925 – Intel Processors
• CVE-2017-5926 – AMD Processors
• CVE-2017-5927 – ARM processors
• CVE-2017-5928 – Browser Timer Issue