Resurrection Attack: Defeating Xilinx MPU's Memory Protection Article Swipe

PDF

Bharadwaj Madabhushi , Chandra Sekhar Mummidi , Sandip Kundu , Daniel Holcomb ·

YOU? · · 2024 · Open Access · · DOI: https://doi.org/10.48550/arxiv.2405.13933

Memory protection units (MPUs) are hardware-assisted security features that are commonly used in embedded processors such as the ARM 940T, Infineon TC1775, and Xilinx Zynq. MPUs partition the memory statically, and set individual protection attributes for each partition. MPUs typically define two protection domains: user mode and supervisor mode. Normally, this is sufficient for protecting the kernel and applications. However, we have discovered a way to access a process memory due to a vulnerability in Xilinx MPU (XMPU) implementation that we call Resurrection Attack. We find that XMPU security policy protects user memory from unauthorized access when the user is active. However, when a user's session is terminated, the contents of the memory region of the terminated process are not cleared. An attacker can exploit this vulnerability by gaining access to the memory region after it has been reassigned. The attacker can read the data from the previous user's memory region, thereby compromising the confidentiality. To prevent the Resurrection Attack, the memory region of a terminated process must be cleared. However, this is not the case in the XMPU implementation, which allows our attack to succeed. The Resurrection Attack is a serious security flaw that could be exploited to steal sensitive data or gain unauthorized access to a system. It is important for users of Xilinx FPGAs to be aware of this vulnerability until this flaw is addressed.

Related Topics

Concepts

Operating system Computer science Computer security Embedded system Business

Metadata

Type: preprint
Language: en
Landing Page: http://arxiv.org/abs/2405.13933
PDF: https://arxiv.org/pdf/2405.13933
OA Status: green
Related Works: 10
OpenAlex ID: https://openalex.org/W4399026162

All OpenAlex metadata

Raw OpenAlex JSON

OpenAlex ID: https://openalex.org/W4399026162

Canonical identifier for this work in OpenAlex
DOI: https://doi.org/10.48550/arxiv.2405.13933

Digital Object Identifier
Title: Resurrection Attack: Defeating Xilinx MPU's Memory Protection

Work title
Type: preprint

OpenAlex work type
Language: en

Primary language
Publication year: 2024

Year of publication
Publication date: 2024-05-22

Full publication date if available
Authors: Bharadwaj Madabhushi, Chandra Sekhar Mummidi, Sandip Kundu, Daniel Holcomb

List of authors in order
Landing page: https://arxiv.org/abs/2405.13933

Publisher landing page
PDF URL: https://arxiv.org/pdf/2405.13933

Direct link to full text PDF
Open access: Yes

Whether a free full text is available
OA status: green

Open access status per OpenAlex
OA URL: https://arxiv.org/pdf/2405.13933

Direct OA link when available
Concepts: Operating system, Computer science, Computer security, Embedded system, Business

Top concepts (fields/topics) attached by OpenAlex
Cited by: 0

Total citation count in OpenAlex
Related works (count): 10

Other works algorithmically related by OpenAlex

Full payload

id	https://openalex.org/W4399026162
doi	https://doi.org/10.48550/arxiv.2405.13933
ids.doi	https://doi.org/10.48550/arxiv.2405.13933
ids.openalex	https://openalex.org/W4399026162
fwci
type	preprint
title	Resurrection Attack: Defeating Xilinx MPU's Memory Protection
biblio.issue
biblio.volume
biblio.last_page
biblio.first_page
topics[0].id	https://openalex.org/T11424
topics[0].field.id	https://openalex.org/fields/17
topics[0].field.display_name	Computer Science
topics[0].score	0.998199999332428
topics[0].domain.id	https://openalex.org/domains/3
topics[0].domain.display_name	Physical Sciences
topics[0].subfield.id	https://openalex.org/subfields/1702
topics[0].subfield.display_name	Artificial Intelligence
topics[0].display_name	Security and Verification in Computing
topics[1].id	https://openalex.org/T10054
topics[1].field.id	https://openalex.org/fields/17
topics[1].field.display_name	Computer Science
topics[1].score	0.9926000237464905
topics[1].domain.id	https://openalex.org/domains/3
topics[1].domain.display_name	Physical Sciences
topics[1].subfield.id	https://openalex.org/subfields/1708
topics[1].subfield.display_name	Hardware and Architecture
topics[1].display_name	Parallel Computing and Optimization Techniques
topics[2].id	https://openalex.org/T10502
topics[2].field.id	https://openalex.org/fields/22
topics[2].field.display_name	Engineering
topics[2].score	0.9904999732971191
topics[2].domain.id	https://openalex.org/domains/3
topics[2].domain.display_name	Physical Sciences
topics[2].subfield.id	https://openalex.org/subfields/2208
topics[2].subfield.display_name	Electrical and Electronic Engineering
topics[2].display_name	Advanced Memory and Neural Computing
is_xpac	False
apc_list
apc_paid
concepts[0].id	https://openalex.org/C111919701
concepts[0].level	1
concepts[0].score	0.5453289747238159
concepts[0].wikidata	https://www.wikidata.org/wiki/Q9135
concepts[0].display_name	Operating system
concepts[1].id	https://openalex.org/C41008148
concepts[1].level	0
concepts[1].score	0.5334109663963318
concepts[1].wikidata	https://www.wikidata.org/wiki/Q21198
concepts[1].display_name	Computer science
concepts[2].id	https://openalex.org/C38652104
concepts[2].level	1
concepts[2].score	0.4880870580673218
concepts[2].wikidata	https://www.wikidata.org/wiki/Q3510521
concepts[2].display_name	Computer security
concepts[3].id	https://openalex.org/C149635348
concepts[3].level	1
concepts[3].score	0.42666497826576233
concepts[3].wikidata	https://www.wikidata.org/wiki/Q193040
concepts[3].display_name	Embedded system
concepts[4].id	https://openalex.org/C144133560
concepts[4].level	0
concepts[4].score	0.3485773801803589
concepts[4].wikidata	https://www.wikidata.org/wiki/Q4830453
concepts[4].display_name	Business
keywords[0].id	https://openalex.org/keywords/operating-system
keywords[0].score	0.5453289747238159
keywords[0].display_name	Operating system
keywords[1].id	https://openalex.org/keywords/computer-science
keywords[1].score	0.5334109663963318
keywords[1].display_name	Computer science
keywords[2].id	https://openalex.org/keywords/computer-security
keywords[2].score	0.4880870580673218
keywords[2].display_name	Computer security
keywords[3].id	https://openalex.org/keywords/embedded-system
keywords[3].score	0.42666497826576233
keywords[3].display_name	Embedded system
keywords[4].id	https://openalex.org/keywords/business
keywords[4].score	0.3485773801803589
keywords[4].display_name	Business
language	en
locations[0].id	pmh:oai:arXiv.org:2405.13933
locations[0].is_oa	True
locations[0].source.id	https://openalex.org/S4306400194
locations[0].source.issn
locations[0].source.type	repository
locations[0].source.is_oa	True
locations[0].source.issn_l
locations[0].source.is_core	False
locations[0].source.is_in_doaj	False
locations[0].source.display_name	arXiv (Cornell University)
locations[0].source.host_organization	https://openalex.org/I205783295
locations[0].source.host_organization_name	Cornell University
locations[0].source.host_organization_lineage	https://openalex.org/I205783295
locations[0].license	cc-by
locations[0].pdf_url	https://arxiv.org/pdf/2405.13933
locations[0].version	submittedVersion
locations[0].raw_type	text
locations[0].license_id	https://openalex.org/licenses/cc-by
locations[0].is_accepted	False
locations[0].is_published	False
locations[0].raw_source_name
locations[0].landing_page_url	http://arxiv.org/abs/2405.13933
locations[1].id	doi:10.48550/arxiv.2405.13933
locations[1].is_oa	True
locations[1].source.id	https://openalex.org/S4306400194
locations[1].source.issn
locations[1].source.type	repository
locations[1].source.is_oa	True
locations[1].source.issn_l
locations[1].source.is_core	False
locations[1].source.is_in_doaj	False
locations[1].source.display_name	arXiv (Cornell University)
locations[1].source.host_organization	https://openalex.org/I205783295
locations[1].source.host_organization_name	Cornell University
locations[1].source.host_organization_lineage	https://openalex.org/I205783295
locations[1].license	cc-by
locations[1].pdf_url
locations[1].version
locations[1].raw_type	article
locations[1].license_id	https://openalex.org/licenses/cc-by
locations[1].is_accepted	False
locations[1].is_published
locations[1].raw_source_name
locations[1].landing_page_url	https://doi.org/10.48550/arxiv.2405.13933
indexed_in	arxiv, datacite
authorships[0].author.id	https://openalex.org/A5098838401
authorships[0].author.orcid
authorships[0].author.display_name	Bharadwaj Madabhushi
authorships[0].author_position	first
authorships[0].raw_author_name	Madabhushi, Bharadwaj
authorships[0].is_corresponding	False
authorships[1].author.id	https://openalex.org/A5083463662
authorships[1].author.orcid	https://orcid.org/0000-0002-3600-9432
authorships[1].author.display_name	Chandra Sekhar Mummidi
authorships[1].author_position	middle
authorships[1].raw_author_name	Mummidi, Chandra Sekhar
authorships[1].is_corresponding	False
authorships[2].author.id	https://openalex.org/A5054064879
authorships[2].author.orcid	https://orcid.org/0000-0001-8221-3824
authorships[2].author.display_name	Sandip Kundu
authorships[2].author_position	middle
authorships[2].raw_author_name	Kundu, Sandip
authorships[2].is_corresponding	False
authorships[3].author.id	https://openalex.org/A5052791292
authorships[3].author.orcid	https://orcid.org/0000-0002-2052-9820
authorships[3].author.display_name	Daniel Holcomb
authorships[3].author_position	last
authorships[3].raw_author_name	Holcomb, Daniel
authorships[3].is_corresponding	False
has_content.pdf	True
has_content.grobid_xml	True
is_paratext	False
open_access.is_oa	True
open_access.oa_url	https://arxiv.org/pdf/2405.13933
open_access.oa_status	green
open_access.any_repository_has_fulltext	False
created_date	2025-10-10T00:00:00
display_name	Resurrection Attack: Defeating Xilinx MPU's Memory Protection
has_fulltext	True
is_retracted	False
updated_date	2025-11-06T06:51:31.235846
primary_topic.id	https://openalex.org/T11424
primary_topic.field.id	https://openalex.org/fields/17
primary_topic.field.display_name	Computer Science
primary_topic.score	0.998199999332428
primary_topic.domain.id	https://openalex.org/domains/3
primary_topic.domain.display_name	Physical Sciences
primary_topic.subfield.id	https://openalex.org/subfields/1702
primary_topic.subfield.display_name	Artificial Intelligence
primary_topic.display_name	Security and Verification in Computing
related_works	https://openalex.org/W4391375266, https://openalex.org/W2748952813, https://openalex.org/W2390279801, https://openalex.org/W2358668433, https://openalex.org/W4396701345, https://openalex.org/W2376932109, https://openalex.org/W2001405890, https://openalex.org/W4396696052, https://openalex.org/W2382290278, https://openalex.org/W4395014643
cited_by_count	0
locations_count	2
best_oa_location.id	pmh:oai:arXiv.org:2405.13933
best_oa_location.is_oa	True
best_oa_location.source.id	https://openalex.org/S4306400194
best_oa_location.source.issn
best_oa_location.source.type	repository
best_oa_location.source.is_oa	True
best_oa_location.source.issn_l
best_oa_location.source.is_core	False
best_oa_location.source.is_in_doaj	False
best_oa_location.source.display_name	arXiv (Cornell University)
best_oa_location.source.host_organization	https://openalex.org/I205783295
best_oa_location.source.host_organization_name	Cornell University
best_oa_location.source.host_organization_lineage	https://openalex.org/I205783295
best_oa_location.license	cc-by
best_oa_location.pdf_url	https://arxiv.org/pdf/2405.13933
best_oa_location.version	submittedVersion
best_oa_location.raw_type	text
best_oa_location.license_id	https://openalex.org/licenses/cc-by
best_oa_location.is_accepted	False
best_oa_location.is_published	False
best_oa_location.raw_source_name
best_oa_location.landing_page_url	http://arxiv.org/abs/2405.13933
primary_location.id	pmh:oai:arXiv.org:2405.13933
primary_location.is_oa	True
primary_location.source.id	https://openalex.org/S4306400194
primary_location.source.issn
primary_location.source.type	repository
primary_location.source.is_oa	True
primary_location.source.issn_l
primary_location.source.is_core	False
primary_location.source.is_in_doaj	False
primary_location.source.display_name	arXiv (Cornell University)
primary_location.source.host_organization	https://openalex.org/I205783295
primary_location.source.host_organization_name	Cornell University
primary_location.source.host_organization_lineage	https://openalex.org/I205783295
primary_location.license	cc-by
primary_location.pdf_url	https://arxiv.org/pdf/2405.13933
primary_location.version	submittedVersion
primary_location.raw_type	text
primary_location.license_id	https://openalex.org/licenses/cc-by
primary_location.is_accepted	False
primary_location.is_published	False
primary_location.raw_source_name
primary_location.landing_page_url	http://arxiv.org/abs/2405.13933
publication_date	2024-05-22
publication_year	2024
referenced_works_count	0
abstract_inverted_index.a	63, 67, 72, 103, 164, 190, 207
abstract_inverted_index.An	121
abstract_inverted_index.It	209
abstract_inverted_index.To	155
abstract_inverted_index.We	84
abstract_inverted_index.as	16
abstract_inverted_index.be	168, 196, 218
abstract_inverted_index.by	127
abstract_inverted_index.in	12, 74, 176
abstract_inverted_index.is	51, 99, 106, 172, 189, 210, 226
abstract_inverted_index.it	135
abstract_inverted_index.of	110, 114, 163, 214, 220
abstract_inverted_index.or	202
abstract_inverted_index.to	65, 71, 130, 184, 198, 206, 217
abstract_inverted_index.we	60, 80
abstract_inverted_index.ARM	18
abstract_inverted_index.MPU	76
abstract_inverted_index.The	139, 186
abstract_inverted_index.and	22, 30, 46, 57
abstract_inverted_index.are	4, 9, 118
abstract_inverted_index.can	123, 141
abstract_inverted_index.due	70
abstract_inverted_index.for	35, 53, 212
abstract_inverted_index.has	136
abstract_inverted_index.not	119, 173
abstract_inverted_index.our	182
abstract_inverted_index.set	31
abstract_inverted_index.the	17, 27, 55, 97, 108, 111, 115, 131, 143, 146, 153, 157, 160, 174, 177
abstract_inverted_index.two	41
abstract_inverted_index.way	64
abstract_inverted_index.MPUs	25, 38
abstract_inverted_index.XMPU	87, 178
abstract_inverted_index.been	137
abstract_inverted_index.call	81
abstract_inverted_index.case	175
abstract_inverted_index.data	144, 201
abstract_inverted_index.each	36
abstract_inverted_index.find	85
abstract_inverted_index.flaw	193, 225
abstract_inverted_index.from	93, 145
abstract_inverted_index.gain	203
abstract_inverted_index.have	61
abstract_inverted_index.mode	45
abstract_inverted_index.must	167
abstract_inverted_index.read	142
abstract_inverted_index.such	15
abstract_inverted_index.that	8, 79, 86, 194
abstract_inverted_index.this	50, 125, 171, 221, 224
abstract_inverted_index.used	11
abstract_inverted_index.user	44, 91, 98
abstract_inverted_index.when	96, 102
abstract_inverted_index.940T,	19
abstract_inverted_index.FPGAs	216
abstract_inverted_index.Zynq.	24
abstract_inverted_index.after	134
abstract_inverted_index.aware	219
abstract_inverted_index.could	195
abstract_inverted_index.mode.	48
abstract_inverted_index.steal	199
abstract_inverted_index.units	2
abstract_inverted_index.until	223
abstract_inverted_index.users	213
abstract_inverted_index.which	180
abstract_inverted_index.(MPUs)	3
abstract_inverted_index.(XMPU)	77
abstract_inverted_index.Attack	188
abstract_inverted_index.Memory	0
abstract_inverted_index.Xilinx	23, 75, 215
abstract_inverted_index.access	66, 95, 129, 205
abstract_inverted_index.allows	181
abstract_inverted_index.attack	183
abstract_inverted_index.define	40
abstract_inverted_index.kernel	56
abstract_inverted_index.memory	28, 69, 92, 112, 132, 149, 161
abstract_inverted_index.policy	89
abstract_inverted_index.region	113, 133, 162
abstract_inverted_index.user's	104, 148
abstract_inverted_index.Attack,	159
abstract_inverted_index.Attack.	83
abstract_inverted_index.TC1775,	21
abstract_inverted_index.active.	100
abstract_inverted_index.exploit	124
abstract_inverted_index.gaining	128
abstract_inverted_index.prevent	156
abstract_inverted_index.process	68, 117, 166
abstract_inverted_index.region,	150
abstract_inverted_index.serious	191
abstract_inverted_index.session	105
abstract_inverted_index.system.	208
abstract_inverted_index.thereby	151
abstract_inverted_index.However,	59, 101, 170
abstract_inverted_index.Infineon	20
abstract_inverted_index.attacker	122, 140
abstract_inverted_index.cleared.	120, 169
abstract_inverted_index.commonly	10
abstract_inverted_index.contents	109
abstract_inverted_index.domains:	43
abstract_inverted_index.embedded	13
abstract_inverted_index.features	7
abstract_inverted_index.previous	147
abstract_inverted_index.protects	90
abstract_inverted_index.security	6, 88, 192
abstract_inverted_index.succeed.	185
abstract_inverted_index.Normally,	49
abstract_inverted_index.exploited	197
abstract_inverted_index.important	211
abstract_inverted_index.partition	26
abstract_inverted_index.sensitive	200
abstract_inverted_index.typically	39
abstract_inverted_index.addressed.	227
abstract_inverted_index.attributes	34
abstract_inverted_index.discovered	62
abstract_inverted_index.individual	32
abstract_inverted_index.partition.	37
abstract_inverted_index.processors	14
abstract_inverted_index.protecting	54
abstract_inverted_index.protection	1, 33, 42
abstract_inverted_index.sufficient	52
abstract_inverted_index.supervisor	47
abstract_inverted_index.terminated	116, 165
abstract_inverted_index.reassigned.	138
abstract_inverted_index.statically,	29
abstract_inverted_index.terminated,	107
abstract_inverted_index.Resurrection	82, 158, 187
abstract_inverted_index.compromising	152
abstract_inverted_index.unauthorized	94, 204
abstract_inverted_index.applications.	58
abstract_inverted_index.vulnerability	73, 126, 222
abstract_inverted_index.implementation	78
abstract_inverted_index.implementation,	179
abstract_inverted_index.confidentiality.	154
abstract_inverted_index.hardware-assisted	5
cited_by_percentile_year
countries_distinct_count	0
institutions_distinct_count	4
citation_normalized_percentile