Researchers from the Helmholtz Center for Information Security (CISPA) have published findings on the security vulnerabilities of processors based on the RISC-V architecture, revealing details about a vulnerability code-named GhostWrite. This vulnerability affects RISC-V processors XuanTie C910 produced by the Chinese company T-Head (a subsidiary of Alibaba) and developed in the form of open projects. The vulnerability allows an attacker with limited unprivileged access to the system to read and write to any areas of physical memory and gain access to control peripheral devices such as network cards using MMIO (Memory-Mapped Input/Output).
The vulnerability is caused by shortcomings in the processor architecture related to the isolation of additional instructions added by the manufacturer, which expand the RISC-V instruction set architecture and enable direct access to DRAM, bypassing virtual memory mechanisms. The operation of some extended instructions directly with physical memory instead of virtual memory allows for bypassing memory isolation between processes.
The prepared attack technique is 100% reproducible and requires executing its code within just a few microseconds. Software isolation methods such as containers and sandbox environments do not prevent exploitation of the vulnerability. The only way to block the vulnerability is by completely disabling support for vector extensions, which results in a 33% performance drop in the rvv-bench tests (the report annotation states 77%, but the summary page lists 33%, while details mention a 33% drop in memcpy performance and an 8% drop in memset performance), and also roughly halves the available instruction set for applications.
The CPU XuanTie C910 is one of the highest-performing RISC-V chips available on the market and is already actively used in servers cloud systems and laptops. For example, the problem manifests in Scaleway Elastic Metal RV1 servers, Lichee Cluster 4A clusters, Lichee Book 4A laptops, Lichee Console 4A gaming consoles, Lichee Pocket 4A portable computers, Sipeed Lichee Pi 4A single-board PCs, Milk-V Meles, and BeagleV-Ahead.
As an example, researchers have prepared an exploit that allows a non-privileged user to gain root access in Linux. The exploit alters the contents of the page table in memory used for translating virtual addresses to physical ones, enabling the retrieval of virtual addresses associated with any physical addresses. An example exploit has also been prepared to read the contents of kernel memory and other processes, allowing the extraction of encryption keys and passwords stored in memory.
Additionally, researchers have identified two less serious architectural vulnerabilities — one affecting T-Head XuanTie C906 processors and the other T-Head XuanTie C908. Both vulnerabilities are limited to denial of service due to CPU halting. These vulnerabilities could pose a risk to cloud platforms built on T-Head XuanTie chips, as having code execution access in a cloud environment could halt the operation of other users serviced on the same infrastructure. server.
The issues were identified using the RISCVuzz framework, created for fuzz testing CPUs. The framework reveals differences in the implementation of the same extended instructions across different CPUs, based on the premise that due to the absence of a unified extension register for the RISC-V instruction set, identically encoded instructions on chips from different manufacturers may lead to different outcomes. The verification involved comparing the behavior of processor instructions on various RISC-V CPUs and analyzing potential vulnerabilities in situations where behavioral discrepancies were observed.
Source: opennet.ru
