A group of researchers from the Vrije Universiteit Amsterdam has released the Kasper toolkit, designed to identify code snippets in the Linux kernel that can be exploited for Spectre-class vulnerabilities caused by speculative execution by the processor. The source code of the toolkit is distributed under the Apache 2.0 license.
Recall that to carry out attacks like Spectre v1, which allow for the determination of memory contents, a specific sequence of commands (gadgets) must be present in privileged code, leading to speculative execution of instructions. To optimize, the processor begins executing such gadgets in speculative mode, then determines that the branch prediction was incorrect and rolls back the operations to their original state, but the data processed during speculative execution remains in the cache and microarchitectural buffers, making it available for extraction through various side-channel data recovery methods.
Previously available tools for scanning gadgets for the Spectre vulnerability, based on pattern matching, showed a very high level of false positives while missing many real gadgets (experiments showed that 99% of the gadgets identified by such tools could not be used for attacks, and 33% of operational gadgets capable of leading to an attack were not detected).
To improve the accuracy of problematic gadget identification, Kasper simulates vulnerabilities that an attacker can exploit at each stage of executing Spectre-class attacks — issues are modeled that allow control over data (for example, injecting the attacker's data into microarchitectural structures to influence subsequent speculative execution through LVI-class attacks), gaining access to confidential information (for instance, through buffer overflows or using memory after it has been freed), and organizing leaks of confidential information (for example, by analyzing the state of the processor cache or using the MDS method).
During testing, the kernel interacts with the Kasper runtime libraries and checks operating at the LLVM level. The verification process involves emulating speculative code execution, implemented via a checkpoint-restore mechanism that specifically executes the mis-predicted branch of code and then rolls back to its original state before branching. Kasper also attempts to model various software and hardware vulnerabilities, analyzes the impact of architectural and microarchitectural effects, and conducts fuzz testing of potential attacker actions. For analyzing execution flows, the DataFlowSanitizer port for the Linux kernel is used, and for fuzz testing, a modified version of the syzkaller package is utilized.
During the scanning of the Linux kernel with Kasper, 1,379 previously unknown gadgets were identified that could potentially lead to data leaks during speculative instruction execution. It is noted that only a portion of these may pose real problems, but to demonstrate that there is indeed a real threat and not just a theoretical one, a working prototype exploit was developed for one problematic code snippet, which leads to information leakage from the kernel's memory.
Source: opennet.ru
