{"id":104644,"date":"2022-07-13T15:36:38","date_gmt":"2022-07-13T13:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/retbleed-novaya-ataka-na-mehanizm-spekulyativnogo-vypolneniya-cpu-intel-i-amd"},"modified":"2022-07-13T15:36:38","modified_gmt":"2022-07-13T13:36:38","slug":"retbleed-novaya-ataka-na-mehanizm-spekulyativnogo-vypolneniya-cpu-intel-i-amd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/retbleed-novaya-ataka-na-mehanizm-spekulyativnogo-vypolneniya-cpu-intel-i-amd","title":{"rendered":"Retbleed \u2014 a new attack on the speculative execution mechanism of Intel and AMD CPUs.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A group of researchers from the Swiss Federal Institute of Technology in Zurich has discovered a new variant of attack on the speculative execution mechanism of indirect jumps in CPUs, allowing the extraction of information from kernel memory or facilitating attacks on the host system from virtual machines. The vulnerabilities have been coded as Retbleed (CVE-2022-29900, CVE-2022-29901) and are similar in nature to Spectre-v2 attacks. The difference lies in organizing speculative execution of arbitrary code when processing the 'ret' instruction, which retrieves an address for the jump from the stack, rather than performing an indirect jump using the 'jmp' instruction that loads the address from memory or the CPU register. <\/p>\n
An attacker can create conditions for incorrect branch prediction and orchestrate a targeted speculative jump to a block of code not intended by the program's execution logic. Ultimately, the processor will determine that the branch prediction was incorrect and roll back the operation to its initial state, but the data processed during speculative execution will reside in the cache and microarchitectural buffers. If the incorrectly executed block accesses memory, its speculative execution will result in data being cached from memory. <\/p>\n
To determine data that remains in the cache after speculative execution of operations, an attacker can employ methods to infer residual data through side channels, such as analyzing access time changes to cached and uncached data. For targeted information extraction from areas in another privilege level (for example, from kernel memory), 'gadgets' are used\u2014sequences of instructions present in the kernel, suitable for speculative reading of data from memory depending on external conditions influenced by the attacker. <\/p>\n
To protect against classic Spectre-class attacks that exploit conditional and indirect jump instructions, most operating systems employ the 'retpoline' technique, which replaces indirect jump operations with the 'ret' instruction. For this operation, processors use a separate stack state prediction block that does not utilize a branch prediction block. When retpoline was introduced in 2018, it was believed that Spectre-like address manipulation would not be practically applicable for speculative jumps using the 'ret' instruction. <\/p>\n
The researchers who developed the Retbleed attack method demonstrated the possibility of creating microarchitectural conditions for initiating a speculative jump using the 'ret' instruction and published a ready-to-use toolkit for identifying in the Linux kernel suitable sequences of instructions (gadgets) that exhibit such conditions for exploitation. <\/p>\n
During the research, a working exploit was prepared that allows arbitrary data to be extracted from kernel memory at a speed of 219 bytes per second with 98% accuracy on systems with Intel CPU from a non-privileged user-space process. On AMD processors, the exploit's efficiency is significantly higher \u2014 the leak speed reaches 3.9 KB per second. As a practical example, it is demonstrated how to determine the contents of the file \/etc\/shadow using the proposed exploit. On systems with Intel CPU, the attack to determine the password hash for the root user took 28 minutes, while on systems with AMD CPU it took only 6 minutes.
\r\n \r\n
<\/div>\r\n <\/div><\/center> <\/p>\n
The possibility of conducting the attack has been confirmed for Intel processors of the 6th to 8th generations produced before the third quarter of 2019 (including Skylake) and AMD processors based on Zen 1, Zen 1+, and Zen 2 microarchitectures produced before the second quarter of 2021. In newer processor models, such as AMD Zen3 and Intel Alder Lake, as well as ARM processors, the issue is mitigated by existing protection mechanisms. For instance, the use of IBRS (Indirect Branch Restricted Speculation) instructions helps defend against the attack. <\/p>\n
A set of changes has been prepared for the Linux kernel and Xen hypervisor to block the problem programmatically on older CPUs. The proposed patch for the Linux kernel modifies 68 files, adds 1783 lines, and removes 387 lines. Unfortunately, this protection incurs significant overhead \u2014 in conducted tests on AMD and Intel processors, the performance degradation is estimated between 14% and 39%. A more preferable option is to apply protection based on IBRS instructions, available in newer generations of Intel CPUs and supported starting from Linux kernel 4.19. <\/p>\n
On Intel processors, the address substitution for speculative indirect jumps is performed due to a feature that manifests during underflow in the Return Stack Buffer. Under such conditions, the addressing logic for the instruction 'ret' begins to behave similarly to what is used in standard indirect jumps. The Linux kernel has identified over a thousand instances that create conditions for initiating such reverse underflows accessible via system calls. <\/p>\n
On AMD processors, the speculative execution of the 'ret' instruction occurs without being tied to the stack-specific Return Address Stack, and the prediction block treats the 'ret' instruction not as a return of control but as an indirect jump, and consequently uses data for indirect jumps in its predictions. Under such conditions, virtually any 'ret' operation reachable via a system call can be exploited. <\/p>\n
Additionally, another issue has been identified in AMD's CPU (CVE-2022-23825, Branch Type Confusion), related to the execution of misleading jumps \u2014 conditions for jump prediction can occur even without the necessary branching instructions, which allows for influencing the branch prediction buffer without a 'ret' instruction. This characteristic significantly complicates the implementation of protection and requires more active clearing of the branch prediction buffer. It is expected that adding full protection to the kernel will result in an overhead increase of 209%. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Play](\"https:\/\/img.youtube.com\/vi\/dmSPvJxPm80\/hqdefault.jpg\")
\r\n