Memory Cache Attacks on Alluxio Impede High Performance Computing

Alluxio is a popular distributed memory storage system, which becomes increasingly important in big data ecosystem by providing high performance storage for computing framework. We point out that there are security vulnerabilities in cache mechanism, data short-circuit read/write mechanism and consistency check mechanism of Alluxio, which may result in the failure of data availability and integrity. Firstly, we find that the lack of limitation of cached copies in the cache mechanism causes the malicious memory consumption attack. An adversary can craft a malicious job to consume the scarce memory storage at a low cost, which will significantly influence the performance of normal users with a degradation of 20%-59%. Secondly, we are aware that the lack of access control and integrity check on the data block will lead to target file tamper attack, in which a target file cached in memory will be modified and considered correctly as long as the size remains unchanged. The tampered file will be read and thus causes a wrong result. Finally, we discuss some corresponding countermeasures for defending these two kinds of memory cache attacks.