Resurrection Attack: Defeating Xilinx MPU's Memory Protection

TL;DR

This paper reveals a critical flaw in Xilinx MPSoC memory protection: the XMPU does not sanitize memory after a terminated process, enabling an attacker to read memory residues from DRAM or other memory regions. It models a realistic adversary with legitimate XMPU control access who leverages address mappings and memory-residues to reconstruct victim activity using a six-step methodology that includes polling PIDs, manipulating XMPU settings, translating virtual to physical addresses, and direct memory reads. The authors provide extensive experimental results on a ZCU102 platform, demonstrating reads of data such as $0x11223344$ and $0xaabbccdd$ after termination, regardless of whether isolation is re-enabled, highlighting a concrete security gap. They argue for memory sanitization upon process termination or other mitigations, noting the performance trade-offs of reconfiguration, and call for secure architectural changes to prevent leakage in multi-tenant FPGA deployments.

Abstract

Memory protection units (MPUs) are hardware-assisted security features that are commonly used in embedded processors such as the ARM 940T, Infineon TC1775, and Xilinx Zynq. MPUs partition the memory statically, and set individual protection attributes for each partition. MPUs typically define two protection domains: user mode and supervisor mode. Normally, this is sufficient for protecting the kernel and applications. However, we have discovered a way to access a process memory due to a vulnerability in Xilinx MPU (XMPU) implementation that we call Resurrection Attack. We find that XMPU security policy protects user memory from unauthorized access when the user is active. However, when a user's session is terminated, the contents of the memory region of the terminated process are not cleared. An attacker can exploit this vulnerability by gaining access to the memory region after it has been reassigned. The attacker can read the data from the previous user's memory region, thereby compromising the confidentiality. To prevent the Resurrection Attack, the memory region of a terminated process must be cleared. However, this is not the case in the XMPU implementation, which allows our attack to succeed. The Resurrection Attack is a serious security flaw that could be exploited to steal sensitive data or gain unauthorized access to a system. It is important for users of Xilinx FPGAs to be aware of this vulnerability until this flaw is addressed.

Figures (18)

• Figure 1: Zynq UltraScale+ Architecture
• Figure 2: Target Board (Xilinx's Zynq ZCU102)
• Figure 3: Oscar writes into Bob's memory addresses when XMPU is disabled.
• Figure 4: Bob enables XMPU fence and writes his data.
• Figure 5: Oscar's access attempt to Bob's addresses is denied, triggering an interrupt.