information about a new class of attacks (Load Value Injection, ) on the speculative execution mechanism in Intel CPUs, which can be used to organize the leakage of keys and secret data from Intel SGX enclaves and other processes.
The new class of attacks is based on manipulations of the same microarchitectural structures as in the attacks (Microarchitectural Data Sampling), . Moreover, the new attacks are not blocked by existing protection methods against Meltdown, Spectre, MDS, and other similar attacks. Effective protection against LVI requires hardware modifications to the CPU. When implementing protection in software by adding the LFENCE instruction after each memory load operation and replacing the RET instruction with POP, LFENCE, and JMP, significant overhead is observed—researchers estimate that full software protection could lead to performance degradation between 2 to 19 times.
Partially, the difficulty of blocking the issue is mitigated by the fact that the attack is currently more theoretical than practical (the attack is theoretically possible but very difficult to implement and is only reproducible in synthetic tests).
Intel Corporation the problem a moderate danger level (5.6 out of 10) and a firmware and SDK update for the SGX environment, in which an attempt was made to block the attack through a workaround. The proposed attack methods are currently applicable only to Intel processors, but the possibility of adapting LVI to other processors susceptible to Meltdown-class attacks cannot be ruled out.
The problem was identified in April last year by researcher Jo Van Bulck from KU Leuven, after which, with the participation of 9 researchers from other universities, five basic methods of attack were developed, each allowing for more specific . Independently, in February of this year, researchers from Bitdefender also reported one variant of the LVI attack to Intel. The attack variants differ in the use of various microarchitectural structures, such as the Store Buffer (SB), Line Fill Buffer (LFB), FPU context-switch buffer, and Level 1 Data Cache (L1D), previously used in attacks like , , , , and .
The main LVI from MDS attacks refers to how MDS manipulates the definition of the contents of microarchitectural structures that remain in the cache after speculative exception handling (fault) or load and store operations, while
LVI attacks allow the attacker to substitute their data into microarchitectural structures to influence the subsequent speculative execution of the victim's code. Through these manipulations, the attacker can extract the contents of closed data structures in other processes while executing specific code on the target CPU core.
For in the victim process's code special sequences of code (gadgets) where a value controlled by the attacker is loaded, and loading this value leads to exceptions (fault, abort, or assist), which discard the result and re-execute the instruction. During exception handling, a speculative window occurs, during which data being processed in the gadget leaks. Specifically, the processor begins to speculatively execute a piece of code (gadget), then determines that the prediction was incorrect and rolls back operations to their original state, but the data processed during speculative execution settles in the L1D cache and microarchitectural buffers, making it accessible for extraction using known side-channel residual data detection methods.
An 'assist' exception, unlike a 'fault', is handled internally by the processor without invoking software handlers. Assist can occur, for example, when there is a need to update the A (Accessed) or D (Dirty) bit in the memory page table. The main difficulty of conducting an attack on other processes is how to initiate the occurrence of assist by manipulating the victim process. Currently, there are no reliable methods to do this, but future discoveries cannot be ruled out. The possibility of carrying out an attack has only been confirmed for Intel SGX enclaves; other scenarios are theoretical or reproducible in synthetic conditions (requiring the addition of specific gadgets to the code).
Possible attack vectors:
- Data leakage from kernel structures to user-level processes. The existing protection in the Linux kernel against Spectre class attacks, as well as the SMAP (Supervisor Mode Access Prevention) mechanism, significantly reduces the likelihood of an LVI attack. Additional protection in the kernel may be required if simpler methods for carrying out LVI attacks are discovered in the future.
- Data leakage between different processes. The attack requires specific fragments of code in the application and a method for generating exceptions in the target process.
- Data leakage from the host environment to the guest system. This attack is categorized as overly complex, requiring various difficult-to-implement steps and predictions of activity in the system.
- Data leakage between processes in different guest systems. The attack vector is similar to organizing data leakage between different processes, but additionally requires executing complex manipulations to bypass isolation between guest systems.
Researchers have published demonstrating the principles of carrying out the attack, but they are currently not suitable for real attacks. The first example allows redirecting speculative code execution in the victim process, similar to return-oriented programming (, Return-Oriented Programming). In this example, a specially prepared process acts as the victim, containing the necessary gadgets (applying the attack to real third-party processes is challenging). The second example allows injection into AES encryption calculations within the Intel SGX enclave, facilitating data leakage during speculative execution of instructions to retrieve the value used for the encryption key.
Source: opennet.ru
