A Faster and More Realistic Flush+Reload Attack on AES

Abstract. Cloud’s unrivaled cost effectiveness and on the fly opera-tion versatility is attractive to enterprise and personal users. However, the cloud inherits a dangerous behavior from virtualization systems that poses a serious security risk: resource sharing. This work exploits a shared resource optimization technique called memory deduplication to mount a powerful known-ciphertext only cache side-channel attack on a popu-lar OpenSSL implementation of AES. In contrast to the other cross-VM cache attacks, our attack does not require synchronization with the tar-get server and is fully asynchronous, working in a more realistic scenario with much weaker assumption. Also, our attack succeeds in just 15 sec-onds working across cores in the cross-VM setting. Our results show that there is strong information leakage through cache in virtualized systems and the memory deduplication should be approached with caution