Nowadays, in operating systems, numerous protection mechanisms prevent or limit the user-mode applications to access the kernel's internal information. This is regularly carried out by software-based defenses such as Address Space Layout Randomization (ASLR) and Kernel ASLR (KASLR). They play pronounced roles when the security of sandboxed applications such as Web-browser are considered. Armed with arbitrary write access in the kernel memory, if these protections are bypassed, an attacker could find a suitable Where to Write in order to get an elevation of privilege or maliciously execute codes in ring 0. In this paper, we introduce a reliable method based on Transactional Synchronization Extensions (TSX) side-channel attacks to reveal the address of the Global Descriptor Table (GDT) and Interrupt Descriptor Table (IDT). We indicate that by detecting these addresses, an attack could be executed to sidestep the Intel's User-Mode Instruction Prevention (UMIP) and the Hypervisor-based mitigation and, consequently, neutralized them. The introduced attack is successfully performed after the most recent patches for Meltdown and Spectre. Moreover, the implementation of the proposed attack on different platforms, including the latest releases of Microsoft Windows, Linux, and, Mac OSX with the latest $9^{th}$ generation of Intel processors, shows that the attack is independent of the Operating System implementation. We demonstrate that a combination of this method with call-gate mechanism (available in modern processors) in a chain of attacks will eventually lead to a full system compromise despite the limitations of a super-secure sandboxed environment in the presence of Windows's proprietary Virtualization Based Security (VBS). Finally, we suggest the software-based mitigation to avoid these attacks with an acceptable cost.

中文翻译：

---

一种通过基于 TSX 的侧信道攻击退出 UMIP 和描述符表的方法

如今，在操作系统中，许多保护机制阻止或限制用户模式应用程序访问内核的内部信息。这通常由基于软件的防御措施执行，例如地址空间布局随机化 (ASLR) 和内核 ASLR (KASLR)。当考虑 Web 浏览器等沙盒应用程序的安全性时，它们扮演着重要的角色。拥有内核内存中的任意写访问权限，如果绕过这些保护，攻击者可以找到合适的写入位置以获得特权提升或恶意执行环 0 中的代码。 在本文中，我们介绍了一种可靠的方法基于事务同步扩展 (TSX) 侧信道攻击来揭示全局描述符表 (GDT) 和中断描述符表 (IDT) 的地址。我们指出，通过检测这些地址，可以执行攻击以避开英特尔的用户模式指令保护 (UMIP) 和基于管理程序的缓解措施，从而消除它们。引入的攻击在 Meltdown 和 Spectre 的最新补丁之后成功执行。此外，所提议的攻击在不同平台上的实施，包括最新版本的 Microsoft Windows、Linux 和 Mac OSX 以及最新的 $9^{th}$ 代英特尔处理器，表明该攻击与操作系统无关执行。我们证明，尽管存在 Windows 专有的基于虚拟化的超级安全沙盒环境存在局限性，但在攻击链中将此方法与调用门机制（在现代处理器中可用）相结合，最终将导致整个系统受到损害。安全 (VBS)。最后，我们建议使用基于软件的缓解措施，以可接受的成本避免这些攻击。