Resurrection Attack: Defeating Xilinx MPU's Memory Protection

TL;DR

The paper identifies a security vulnerability in Xilinx MPU's implementation, called Resurrection Attack, which allows attackers to access memory of terminated processes, compromising confidentiality in embedded systems.

Contribution

It uncovers a novel security flaw in Xilinx MPU that enables memory access after process termination, highlighting the need for memory clearing to prevent data leaks.

Findings

Resurrection Attack exploits XMPU's failure to clear memory after process termination.

The attack allows reading previous process data, risking sensitive information exposure.

XMPU implementation lacks automatic memory clearing, enabling the attack.

Abstract

Memory protection units (MPUs) are hardware-assisted security features that are commonly used in embedded processors such as the ARM 940T, Infineon TC1775, and Xilinx Zynq. MPUs partition the memory statically, and set individual protection attributes for each partition. MPUs typically define two protection domains: user mode and supervisor mode. Normally, this is sufficient for protecting the kernel and applications. However, we have discovered a way to access a process memory due to a vulnerability in Xilinx MPU (XMPU) implementation that we call Resurrection Attack. We find that XMPU security policy protects user memory from unauthorized access when the user is active. However, when a user's session is terminated, the contents of the memory region of the terminated process are not cleared. An attacker can exploit this vulnerability by gaining access to the memory region after it has been reassigned. The attacker can read the data from the previous user's memory region, thereby compromising the confidentiality. To prevent the Resurrection Attack, the memory region of a terminated process must be cleared. However, this is not the case in the XMPU implementation, which allows our attack to succeed. The Resurrection Attack is a serious security flaw that could be exploited to steal sensitive data or gain unauthorized access to a system. It is important for users of Xilinx FPGAs to be aware of this vulnerability until this flaw is addressed.