A team of researchers from Seoul University and Samsung has developed an attack technique on ARM processors, codenamed TikTag, which can be used to circumvent the hardware protection mechanism MemTag (MTE, Memory Tagging Extension) present in chips based on the ARMv8.5-A architecture. This attack allows the determination of TikTag tag contents for arbitrary memory addresses due to data leaks caused by the speculative execution of CPU instructions.
The MemTag technology enables tags to be associated with areas in memory and organizes pointer validation checks to block the exploitation of vulnerabilities arising from accessing already freed memory blocks, buffer overflows, and access before initialization. When using MemTag, a 4-bit tag is created for every 16 bytes of physical memory, acting as a key for accessing that memory. The tag can be generated by the application for a designated memory area using specific CPU instructions and then stored in the upper unused bits of the pointer. When accessing memory using a tagged pointer, the processor checks the tag associated with the pointer against the tags linked to the memory blocks and allows access only if the tags match.
The proposed attack method allows the identification of tags linked to memory blocks and circumvents MemTag protection. Researchers demonstrated the ability to execute the TikTag attack by exploiting vulnerabilities in the Linux kernel and Chrome browser, using existing instruction sequences (gadgets) found in these products that lead to speculative code execution. Such gadgets, when executed in speculative mode with pointer operations, trigger reading of MemTag metadata based on external conditions that may be influenced by the attacker. After determining an incorrect prediction, the result of the speculative execution is discarded, but the obtained data remains in the cache and can then be extracted through side-channel analysis. The probability of successfully circumventing the MemTag protection in conducted tests is estimated at 95% when executing the attack for approximately 4 seconds.
Two types of gadgets have been identified that lead to the leakage of information about MemTag tags. In the first case, speculative execution occurs due to an incorrect branch prediction, and the conditions for executing the gadget can be created through manipulation with system calls. In the second case,
speculative execution arises from an error in predicting the relationship between read and write operations when using STLF (Store-To-Load-Forwarding) optimization, which allows for the selection of a tag by evaluating the cache state (if the tag matches, the value will be directly forwarded from the previous 'store' command to the 'load' operation, altering the cache state). The first type of gadget is suitable for attacking the Linux kernel, while the second targets the JavaScript engine V8, used in Chromium-based browsers. A prototype toolkit for conducting the attack has been published on GitHub.
ARM has confirmed the potential for an attack on systems with Cortex-X2, Cortex-X3, Cortex-A510, Cortex-A520, Cortex-A710, Cortex-A715, and Cortex-A720 processors, but does not intend to make changes to the CPU to block the issue, as the MemTag architecture implies that tags are not secret data for applications. The issue also remains unpatched in the Chromium codebase, as MemTag-based protection is not yet enabled by default in the Chrome browser. The team responsible for Android platform security has acknowledged the possibility of an attack on Pixel 8 devices that utilize MemTag protection, added fixes to block leaks, and expressed readiness to award a bounty for the discovered vulnerability.
As workarounds to block the attack, researchers suggest using sb or isb instructions to prevent speculative execution during critical memory operations or introducing padding from other instructions between branching instructions and memory access instructions.
Source: opennet.ru
