【摘要】 现代操作系统采用内核地址空间随机化(KASLR)技术来抵御内核代码重用攻击。处理器微架构侧信道能够泄露内核代码段的页表信息，进而可以被用来绕过KASLR保护，但是现有研究局限于MOV, CMASKMOV,PREFETCHNTA和CLDEMOTE等少数的几条指令来探测内核地址，攻击面有限。为系统评估KASLR攻击面，该文从指令多样性出发，设计一个自动化分析框架，挖掘可以绕过KASLR保护并暴露计算机系统安全脆弱性的指令。该框架不需要逆向微架构部件的实现细节，专注于攻击任务本身，首先将攻击流程抽象为环境准备、内存探测、微架构信息记录和差分分析4个阶段，然后定位绕过KASLR保护的关键攻击代码，最后研究不同指令在替换关键代码后的攻击效果。该文分别从指令的汇编形式和字节形式出发提出两套KASLR攻击面的评估算法，互相验证和补充。实验结果表明，该文在Intel x86指令集挖掘出699条可实现KASLR绕过的汇编指令，相比现有研究依赖的6条指令，实现了KASLR脆弱性指令的跨数量级增长。此外，从字节形式出发的实验数据表明，Intel x86指令集有39个单字节操作码、121个双字节操作码和24个3字节操作码指令可以实现KASLR绕过。该文的发现不仅显著扩展了KASLR的攻击面，更为基于特征检测的防御机制带来挑战和新思路。更多还原

【Abstract】 Objective Kernel Address Space Layout Randomization(KASLR) remains a core defense against kernel-level exploits; however, its robustness is increasingly undermined by microarchitectural side-channel attacks that exploit specific processor instructions. Existing research has largely concentrated on isolated attack vectors,lacking a systematic evaluation of the entire x86 instruction set. This study addresses this limitation by developing an automated framework to identify and characterize KASLR-bypass instructions comprehensively,assess their attack efficacy across multiple Intel processor generations, and derive defensible instruction patterns to inform the reinforcement of current security mechanisms.Methods This study systematically addresses three core challenges in analyzing instruction-level mechanisms for bypassing KASLR. The first challenge is achieving comprehensive coverage of the x86 Instruction Set Architecture(ISA), which includes thousands of historical and modern instructions characterized by variablelength encoding and complex microarchitectural dependencies. To address this, the proposed framework combines static and dynamic analysis. Instruction semantics are extracted statically from Intel Software Developer Manuals and uops.info XML datasets. Dynamic profiling on Intel Core processors is used to verify instruction support across processor generations. Byte-level pattern matching is applied to accurately handle variable-length encodings. The second challenge concerns the generation of attack-compliant machine code that satisfies strict encoding requirements and bypasses compiler-level checks. This is achieved using a templatedriven approach, which modifies a CLFLUSH-based attack prototype by replacing inline assembly instructions through pattern substitution. Memory operands are redirected to target addresses preloaded into the EDX register, with boundary values used to ensure operand validity. For nonstandard or undocumented instructions,self-modifying code techniques dynamically inject opcodes at runtime, thereby bypassing compiler restrictions and enabling broader instruction coverage. The third challenge focuses on evaluating attack effectiveness through accurate localization of kernel symbols. To this end, the framework applies a dual-verification strategy.RDTSC instructions are used to timestamp memory probes across 512 predefined address slots. Differential timing analysis identifies latency outliers(i.e., maximum and minimum values), indicating potential KASLR bypasses. Signal handlers suppress exceptions caused by access to privileged or unmapped memory regions,while debug symbol cross-referencing is used to confirm actual kernel address leakage. All generated code undergoes Monte Carlo simulation to reduce false positives and ensure statistical robustness.Results and Discussions Experiments are performed on Intel Core i7-11700K, i7-12700K, and i7-13 700 processors(Table 1). In the Assembly-Level Instruction Analysis(Fig. 4), 699 assembly instructions are identified as effective KASLR bypass vectors on the i7-11700K. Variations in support for AVX512 instruction set extensions account for differences in the attack surface, with the number of effective instructions decreasing slightly to 542 on the i7-12700K and 547 on the i7-13 700, reflecting minor microarchitectural differences. In the Byte-Level Instruction Analysis(Table 2), 39 one-byte, 121 two-byte, and 24 three-byte opcodes are found to bypass KASLR without relying on predefined assembly semantics. These opcodes demonstrate consistent attack efficacy across all evaluated processors, indicating similar behavioral patterns across Intel architectures. Overall,the results—supported by(Fig. 4, Table 2, Table 3), demonstrate two principal findings: comprehensive coverage of the x86 ISA and cross-generation consistency of effective KASLR bypass instructions. Although the current study focuses on Intel processors, the findings raise open questions regarding the vulnerability of AMD processors that share the same ISA, as well as ARM-based platforms used in Android devices and Apple M series chips. Future work is intended to extend the framework to analyze KASLR bypass vectors on non-Intel architectures. Furthermore, an automated analysis framework is proposed to assess KASLR attack efficacy through differential analysis. To enhance detection across heterogeneous architectures and instruction sets,future efforts will incorporate data preprocessing techniques to improve the scalability and precision.Conclusions KASLR remains a critical defense against kernel memory exploitation; however, its resilience is increasingly challenged by instruction-dependent microarchitectural side-channel attacks. This study presents an automated framework that systematically identifies potential KASLR-bypass instructions, quantifies their attack effectiveness across multiple Intel processor generations, and derives actionable defense signatures to address emerging threats. The findings reveal a significantly underestimated attack surface: hundreds of x86 instructions, at both the assembly and byte levels, are capable of leaking sensitive address information. The broader implications of this work are threefold:(1) Defensive Improvement: The experimental results may be directly applied to enhance signature-based detection systems.(2) Hardware-Software Co-Design: The consistent vulnerability observed across Intel microarchitectures highlights the need to redesign timing isolation mechanisms at the hardware level.(3) Methodological Contribution: The proposed dual-analysis framework offers a generalizable approach for evaluating instruction-level attack surfaces, with applicability to other contexts such as cache-based side-channel attacks. Future research will extend this methodology to alternative architectures, including ARM and RISC-V, and explore the integration of machine learning techniques.更多还原