  Memory utilization can be reduced by merging identical memory blocks into
copy-on-write mappings. Previous work showed that this so-called memory
deduplication can be exploited in local attacks to break ASLR, spy on other
programs,and determine the presence of data, i.e., website images. All these
attacks exploit memory deduplication across security domains, which in turn was
disabled. However, within a security domain or on an isolated system with no
untrusted local access, memory deduplication is still not considered a security
risk and was recently re-enabled on Windows by default.
  In this paper, we present the first fully remote memorydeduplication attacks.
Unlike previous attacks, our attacks require no local code execution.
Consequently, we can disclose memory contents from a remote server merely by
sending and timing HTTP/1 and HTTP/2 network requests. We demonstrate our
attacks on deduplication both on Windows and Linux and attack widely used
server software such as Memcached and InnoDB. Our side channel leaks up to
34.41 B/h over the internet, making it faster than comparable remote
memory-disclosure channels. We showcase our remote memory-deduplication attack
in three case studies: First, we show that an attacker can disclose the
presence of data in memory on a server running Memcached. We show that this
information disclosure channel can also be used for fingerprinting and detect
the correct libc version over the internet in 166.51 s. Second, in combination
with InnoDB, we present an information disclosure attack to leak MariaDB
database records. Third, we demonstrate a fully remote KASLR break in less than
4 minutes allowing to derandomize the kernel image of a virtual machine over
the Internet, i.e., 14 network hops away. We conclude that memory deduplication
must also be considered a security risk if only applied within a single
security domain.
