Intel Corporation Information about the new in its processors — (Microarchitectural Data Sampling). Like previous Spectre class attacks, the new issues may lead to the leakage of sensitive data from the operating system, virtual machines, and other processes. It is claimed that the problems were first identified by Intel employees and partners during an internal audit, after which independent researchers were informed about similar issues at Intel. AMD and ARM processors are not affected by the problem.
Based on the identified issues, researchers from Graz University of Technology (Austria) several practical attacks via side channels:
- () — allows the extraction of confidential information from other processes, the operating system, virtual machines, and protected enclaves (TEE, Trusted Execution Environment). For example, the possibility of determining the history of pages opened in the Tor browser running in another virtual machine was demonstrated, as well as identifying access keys and passwords used in applications;
- () — enables the organization of information leaks between various isolated areas in Intel processors, such as fill buffers, storage buffers, and load ports. Examples of conducting attacks are shown for organizing leaks from other processes, the operating system, virtual machines, and protected enclaves. For instance, it demonstrated how to discover the content of the root password hash from /etc/shadow during periodic authentication attempts (the attack took 24 hours);
Additionally, an example of conducting an attack using JavaScript and WebAssembly when opening a malicious page in the SpiderMonkey engine was shown (in modern full-featured browsers, such an attack is unlikely due to timer precision restrictions and protections against Spectre);
- () — provides the ability to read data recently written by the operating system and determine the memory layout of the OS to facilitate the execution of other attacks;
- — exploits CPU optimizations related to storage buffering and can be used to bypass the kernel address space layout randomization (KASLR) mechanism, for monitoring the operating system state, or for leaks in combination with gadgets based on Spectre methods.
Identified :
- CVE-2018-12126 — MSBDS (Microarchitectural Store Buffer Data Sampling), recovery of storage buffer content. Used in the Fallout attack. The severity level is rated at 6.5 (CVSS);
- CVE-2018-12127 — MLPDS (Microarchitectural Load Port Data Sampling), recovery of load port content. Used in the RIDL attack. CVSS 6.5;
- CVE-2018-12130 — MFBDS (Microarchitectural Fill Buffer Data Sampling), recovery of fill buffer content. Used in the ZombieLoad and RIDL attacks. CVSS 6.5;
- CVE-2019-11091 — MDSUM (Microarchitectural Data Sampling Uncacheable Memory), recovery of uncacheable memory content. Used in the RIDL attack. CVSS 3.8.
Identified issues in the applicability of side-channel analysis methods to data in microarchitectural structures that applications do not have direct access to. This refers to low-level structures such as fill buffers, store buffers, and load ports, which are smaller components than level 1 (L1D) cache, data load cache (RDCL), or L1TF (L1 Terminal Fault), and thus contain less information and are updated more frequently.
Side-channel attacks on microarchitectural structures are significantly more complex to conduct compared to cache content recovery methods and require tracking and analyzing large amounts of data to identify their relationship with specific memory addresses (essentially, an attacker cannot directly intercept specific data but can collect leaks over time and use statistical methods to reconstruct certain types of data). Additionally, the attack only affects data on the same physical CPU core as the attacker's code.
Proposed methods for determining the content of microarchitectural structures are based on the fact that these structures are utilized during speculative exception (fault) or load and store operations.
During speculative execution, the content of internal structures is redirected for processing into registers or cache. Speculative operations do not complete, and the result is discarded, but the redirected content can be identified using side-channel cache analysis methods.
Loading ports are used by the processor to obtain data from memory or the input/output subsystem and provide the retrieved information into CPU registers. Due to the implementation specifics, data from previous loading operations remains in the ports until overwritten by new data, which allows for an indirect determination of data state in the loading port through manipulations with exceptions (faults) and SSE/AVX/AVX-512 instructions that load more than 64 bits of data. In such conditions, loading operations speculatively expose outdated data values from internal structures into dependent operations. A similar leakage is organized through the storage buffer, used to accelerate writes to the CPU cache and includes a table of addresses, values, and flags, as well as through the fill buffer, which contains data not yet available in L1 cache (cache miss) while loading from other level caches.
The Problem Intel processor models released since 2011 (starting from the 6th generation). At the same time, hardware vulnerabilities are blocked starting from certain models of the 8th and 9th generations of Intel Core and the 2nd generation of Intel Xeon Scalable (which can be checked via the ARCH_CAP_MDS_NO bit in IA32_ARCH_CAPABILITIES MSR). Vulnerabilities are also at the firmware, microcode, and operating system levels. According to Intel, the performance loss after the activation of the patch for most users 3%. When disabling Hyper-Threading, the performance drop can reach 9% in the SPECint_rate_base test, up to 11% during active integer computations, and up to 19% when running server Java applications (with HT enabled, performance loss is almost non-existent). The patches practically have no impact on the performance of I/O related operations.
In the Linux kernel, protection against MDS is in today's 5.1.2, 5.0.16,
4.19.43, 4.14.119, and 4.9.176. The protection method on clearing the contents of microarchitectural buffers at the moment of returning from kernel to user space or when passing control to a guest system, using the VERW instruction. For the protections to work, the MD_CLEAR mode support implemented in the latest microcode update is required. For complete protection, it is also recommended to disable Hyper-Threading. To check the system's vulnerability to the exploit in the Linux kernel. The handler "/sys/devices/system/cpu/vulnerabilities/mds". To manage the activation of various vulnerability blocking modes, the kernel has added the parameter "mds=", which can take values "full", "full,nosmt" (disabling Hyper-Threads), "vmwerv" and "off".
Package updates have already been released for and , but remain unavailable for , and .
The fix for blocking data leaks from virtual machines also for the Xen hypervisor. To protect virtualization systems calling the L1D_FLUSH command before handing control over to another virtual machine, and to secure Intel SGX enclaves, a microcode update is sufficient.
Source: opennet.ru
