Avoiding Leakage and Synchronization Attacks through Enclave-Side - PowerPoint PPT Presentation

Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control Marcus Völp, Adam Lackorzynski * , Jérémie Decouchant, Vincent Rahli, Francisco Rocha, and Paulo Esteves-Veríssimo * Kernkonzept GmbH and University of Luxembourg SnT CritiX Lab TU Dresden – Operating-systems group Luxembourg Dresden, Germany <name>.<surname>@uni.lu adam.lackorzynski@kernkonzept.com 1st Workshop on System Software for Trusted Execution (SysTEX 2016), Dec. 12, 2016, Trento, Italy

The functionality/code size dilemma • application scenarios require the system to implement a certain set of functionalities • implementing these functionalities comes at the cost of a certain minimal amount of code – even if development time and costs don’t matter; and – even if you only use high-class developers • correlation of code size and complexity to vulnerabilities – Chou et al., “ An Empirical Study of Operating Systems Errors” , SOSP 2001 – Asadollah et al., “ A Study of Concurrency Bugs in an Open Source Software”, OSS 2016 Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 2

The functionality/code size dilemma • application scenarios require the system to implement a certain set of functionalities • implementing these functionalities comes at the cost of a certain minimal amount of code – even if development time and costs don’t matter; and 5-13 PY • RTOS ca. 5 KLOC formal – even if you only use high-class developers • Microkernel 10 – 15 KLOC verification • correlation of code size and complexity to vulnerabilities • Legacy OS 15 – 50 MLOC – Chou et al., “ An Empirical Study of Operating Systems Errors” , SOSP 2001 – Asadollah et al., “ A Study of Concurrency Bugs in an Open Source Software”, OSS 2016 Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 3

Intransitive trust secure secure App App legacy Player App App Legacy OS Stub FS Driver Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 4

Intransitive trust legacy Player App App Legacy OS secure secure Codec App App Resource Mgmt tudos.org Stub VPFS FS En-/Decryption Driver Framebuffer Mgr. Weinhold et al., “ jVPFS: Adding Robustness to a Secure Stacked File • System with Untrusted Local Storage Components”, USENIX ATC, 2011 Singaravelu et al., “ Reducing TCB Complexity for Security-Sensitive • Applications: Three Case Studies” , Eurosys, 2006 … Asmussen, Völp, … • ASPLOS ‘16 Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 5

Intransitive trust legacy Player App App Legacy OS secure secure Codec App App Resource Mgmt Stub VPFS FS En-/Decryption Driver Framebuffer Mgr. Inktag M3 Intel SGX Hoffmann et al. ‘13 Manycore + DTUs microhypervisor Asmussen, Völp, … ARM Trustzone / … ASPLOS ‘16 Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 6

SGX Vulnerabilities Source: AsyncShock Fine grain preemption control to widen the window of vulnerability of synchronization bugs Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 7

SGX Vulnerabilities Fine grain preemption control to widen the window of vulnerability for side-channel attacks Fine grain preemption control to widen the window of vulnerability of synchronization bugs Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 8

SGX Vulnerabilities • Running Example: Osvik et al., “ Cache Attacks and Countermeasures: the Case of AES” , CT-RSA 2006 in-memory tables T i source: wikimedia Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 9

SGX Vulnerabilities • Running Example: Osvik et al., “ Cache Attacks and Countermeasures: the Case of AES” , CT-RSA 2006 T i R 5 = read T i [x j ] R 0 = xor R 0 , R 5 … read T i [0] T i … read T i [n] Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 10

SGX Vulnerabilities • Running Example: Osvik et al., “ Cache Attacks and Countermeasures: the Case of AES” , CT-RSA 2006 T i R 6 = read T i [0] cmp 0, x j R 5 = cmov R 6 T i R 0 = xor R 0 , R 5 … low indistinguishable data access pattern embedded into low indistinguishable control flow Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 11

SGX Vulnerabilities • Running Example: Osvik et al., “ Cache Attacks and Countermeasures: the Case of AES” , CT-RSA 2006 T i disable preemptions R 5 = read T i [x j ] R 0 = xor R 0 , R 5 … read T i [0] T i … read T i [n] enable preemptions Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 12

This talk Re-investigate delayed-preemption: • How can we allow user-level applications (in enclaves) to disable preemptions without being able to monopolizing the system? • How can we prevent solicited exits through which the management OS could regain control? • How can we translate delayed- preemption to Intel SGX? Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 13

This talk disable preemptions How can we prevent solicited exits in sensitive code? R 5 = read T i [x j ] R 0 = xor R 0 , R 5 … read T i [0] … How can we make sure the enclave enables read T i [n] enable preemptions preemptions again? Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 14

This talk disable preemptions prepare if preempted goto retry How can we prevent solicited exits in sensitive code? R 5 = read T i [x j ] R 0 = xor R 0 , R 5 … read T i [0] … How can we make sure the enclave enables read T i [n] enable preemptions preemptions again? Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 15

Delayed Preemption • … in a Trusted-Trustworthy Hypervisor user / enclave mode kernel mode time execute delayed preemptions disable all interrupts except timer program timer to max_tolerable_delay inform app about pending preemption: p = 1 Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 16

Delayed Preemption • … in a Trusted-Trustworthy Hypervisor … user / enclave mode kernel mode time max_tolerable_delay execute delayed preemptions disable all interrupts except timer program timer to max_tolerable_delay inform app about pending preemption: p = 1 Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 17

Delayed Preemption • … in a Trusted-Trustworthy Hypervisor sensitive code user / enclave mode kernel mode time max_tolerable_delay Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 18

Delayed Preemption • … in SGX xAPIC register sensitive code user / enclave mode kernel mode time max_tolerable_delay Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 19

Delayed Preemption • … in SGX not virtualizable xAPIC register sensitive code user / enclave mode kernel mode time local xAPIC register; max_tolerable_delay max_tolerable_delay write only in kernel mode (i.e., not in enclave mode) xAPIC: set timer on first preemption; don’t interrupt application Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 20

Solicited Exits disable preemptions prepare if preempted goto retry R 5 = read T i [x j ] R 0 = xor R 0 , R 5 … read T i [0] … read T i [n] enable preemptions Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 21

Solicited Exits retry:  xApic.d = 1; Trigger all such exits during non-sensitive prepare phase; prepare Set p flag to make code aware of these exits; if (p = 1) Context switch p flag as part of enclave state goto retry How to prevent solicited exits in sensitive code? R 5 = read T i [x j ] data / instruction page-faults R 0 = xor R 0 , R 5 • lazy FPU context switch … • read T i [0] power management • … device virtualization • read T i [n] xApic.d = 0  max_tolerable_delay // if (xApic.p = 1) -> AEX Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control - SysTEX 2016 - Marcus Völp (marcus.voelp@uni.lu) 22