Tampering the RAM: a new way to break into any VM

We create a simple C program that reads 2 bytes from the test file.

#include <fcntl.h>
#include <unistd.h>
#include <stdint.h>

int main(int argc, char *argv[])
{
  int fd = open("file", O_RDONLY);
  uint8_t buf[2] = {0};
  read(fd, buf, sizeof(buf));
  close(fd);

  return 0;
}

We compile and run the program. Since the fundamental unit is the page, we expect the kernel to cache not only the two bytes requested, but the whole page containing them.

$ vmtouch file 
           Files: 1
     Directories: 0
  Resident Pages: 12/32768  48K/128M  0.0366%
         Elapsed: 0.00183 seconds

Unexpectedly, we don’t find just one page (4 KB) in the cache, but 12 (48 KB). That is because the kernel implements the so-called "read-ahead logic" — to reduce the disk accesses, it caches data that were not explicitly requested, but are likely to be accessed in the near future.

This behavior can be controlled using the posix_fadvise() syscall. Let's see how.

#include <fcntl.h>
#include <unistd.h>
#include <stdint.h>

int main(int argc, char *argv[])
{
  int fd = open("file", O_RDONLY);
  posix_fadvise(fd, 0, 0, POSIX_FADV_RANDOM);
  uint8_t buf[2] = {0};
  read(fd, buf, sizeof(buf));
  close(fd);

  return 0;
}

We clear the cache, compile and run the program. Then we check again the cache status.

$ vmtouch file 
           Files: 1
     Directories: 0
  Resident Pages: 1/32768  4K/128M  0.00305%
         Elapsed: 0.001783 seconds