Researchers from the Defense Science and Technology University of the People's Liberation Army of China, the National University of Singapore, and the Swiss Federal Institute of Technology Zurich have developed a new attack method on isolated Intel SGX (Software Guard eXtensions) enclaves. The attack, named SmashEx, arises from reentrancy issues while handling exceptions during the operation of runtime components for Intel SGX. The proposed attack method allows, with control over the operating system, the identification of confidential data stored in the enclave or facilitates copying of one's code into the enclave's memory and its execution.
Prototypes of exploits have been prepared for enclaves with runtime based on Intel SGX SDK (CVE-2021-0186) and Microsoft Open Enclave (CVE-2021-33767). In the first case, the ability to extract the RSA key used on the web server for HTTPS has been demonstrated, while in the second case, the content retrieved by the cURL utility, running inside the enclave, has been identified. The vulnerability has already been patched programmatically in Intel SGX SDK versions 2.13 and Open Enclave 0.17.1. In addition to Intel SGX SDK and Microsoft Open Enclave packages, the vulnerability is also present in Google Asylo SDK, EdgelessRT, Apache Teaclave, Rust SGX SDK, SGX-LKL, CoSMIX, and Veracruz.
It is worth noting that the SGX (Software Guard Extensions) technology appeared in Intel Core processors of the sixth generation (Skylake) and offers a series of instructions that allow allocating protected memory areasāenclavesāfor user-level applications, the contents of which cannot be read or modified even by the kernel and code executing in ring0, SMM, and VMM modes. Control transfer to code in the enclave is impossible using traditional jump functions and manipulations with registers and the stack; instead, specially created new instructions EENTER, EEXIT, and ERESUME, which perform authority checks, are used to transfer control to the enclave. The code placed in the enclave can utilize classic calling methods to invoke functions within the enclave and a special instruction to call external functions. To protect against hardware attacks, such as connecting to the DRAM module, enclave memory is encrypted.
The problem arises from the fact that the SGX technology allows the operating system to interrupt the execution of enclaves by generating a hardware exception, and enclaves do not properly implement primitives for atomic handling of such exceptions. Unlike the operating system kernel and regular applications, code within enclaves does not have access to primitives for organizing atomic actions during the handling of asynchronously occurring exceptions. Without these atomic primitives, an enclave can be interrupted at any time and returned to execution, even during critical sections when it is in an unsafe state (for example, when CPU registers are not saved/restored).
For proper functioning, the SGX technology allows the interruption of enclave execution by customizable hardware exceptions. This feature enables enclave runtime environments to implement handling of intra-enclave exceptions or signal handling, but it can also provoke reentrancy errors. The SmashEx attack relies on exploiting shortcomings in the SDK that lead to improper handling of the situation of a recurring call to the exception handler. Importantly, to exploit the vulnerability, the attacker must be able to interrupt enclave execution, i.e., they must control the operation of the system environment.
After generating an exception, the attacker has a small time window during which they can intercept the execution flow by manipulating input parameters. In particular, with access to the system (the environment outside the enclave), it is possible to create a new exception immediately after executing the enclave entry instruction (EENTER), which will lead to the return of control to the system at a stage when the enclave stack setup has not yet been completed, including the preservation of CPU register states.
The system can then return control back to the enclave, but since the enclave's stack was not set up during the interrupt, the enclave will execute with the stack that exists in the system memory, which can be used to apply return-oriented programming (ROP) exploitation methods. When using ROP technique, the attacker does not attempt to place their own code in memory but operates with already loaded library fragments of machine instructions that end with a return control instruction (typically the ends of library functions). The exploit works by constructing a chain of calls of such blocks ('gadgets') to achieve the desired functionality.
Source: opennet.ru
