Work

Timing and Speculative Execution Attacks: Defeating State-of-the-Art Code-Reuse Defenses

Year: 2025

Type: article

Abstract: Recently, numerous effective defensive strategies like ASLR and execute-no-read have been put forward to counter code-reuse attacks in software systems. These methods safeguard systems robustly by addressing randomization or memory access constraints. However, this paper uncovers a novel vulnerability in these approaches: the lack of time protection. We present a new assault method named the timing function attack. This attack can initiate a code-reuse attack even against cutting-edge defense techniques. By exploiting the time channel, we can obtain crucial security information despite previous attempts to hide spatial details. Specifically, we use function execution time for side-channel attacks, de-randomize code segment layouts and then execute a code-reuse attack. To verify its practicality, we conduct attacks on ChakraCore and Chrome v8 JavaScript engines. Results show it can bypass defenses like function-granularity ASLR and XnR, escalating privileges. We also introduce SAROP, which uses speculative execution vulnerabilities to bypass address randomization. We compare these two attacks and discuss defense mechanisms, emphasizing the need for multi-layered security.

Source: IEEE Access

DOI: 10.1109/access.2025.3573038

Authors: Zhang Tianning, Cai Miao, Zhang Diming, Huang Hao

Institutions: Jiangsu University of Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing University

Language: English

Topic: Security and Verification in Computing

Subfield: Artificial Intelligence

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

Estimated APC paid: $2,075

Funders: Natural Science Foundation of Jiangsu Province, Council for Science, Technology and Innovation, Fundamental Research Funds for the Central Universities