Foreshadow: speculative attacks on SGX and beyond Mark Silberstein Joint work with Jo Van Bulck, Marina Minkin , Ofir Weisse, Daniel Genkin, Baris Kasikci, Frank Piessens, Thomas F. Wenisch, Yuval Yarom, and Raoul Strackx March 2019 Mark Silberstein, Technion 1
Big picture in one slide ● Where do CPUs loose performance? – Branches, Memory translation – Technology scaling does not help March 2019 Mark Silberstein, Technion 2
Big picture in one slide ● Where do CPUs loose performance? – Branches, Memory translation – Technology scaling does not help ● Speculative execution for latency hiding – CPU speculates the outcome of slow operations – Continues execution assuming speculation is correct – Rolls back the modified architectural state otherwise March 2019 Mark Silberstein, Technion 3
Speculative execution attacks exploit Speculation past illegal memory accesses Inability to fully roll back μarch state Covert/side channels to leak the state March 2019 Mark Silberstein, Technion 4
Today ● Background ● From Meltdown to Foreshadow ● SGX: Collateral damage ● Foreshadow-NG (L1TF) ● Discussion March 2019 Mark Silberstein, Technion 5
Speculative execution 101 Instruction stream Completed instructions CPU 1 2 Slow instruction 3 Execute Retire (commit results) 4 5 6 Depend on 3 March 2019 Mark Silberstein, Technion 6
Speculative execution 101 Instruction stream Completed instructions CPU 2 1 3 Execute Retire (commit results) 4 5 6 March 2019 Mark Silberstein, Technion 7
Speculative execution 101 Instruction stream Completed instructions CPU 1 2 3 Execute Retire (commit results) 4 5 6 March 2019 Mark Silberstein, Technion 8
Speculative execution 101 Instruction stream Completed instructions Slow CPU 1 T slow 2 3 Execute Retire (commit results) 4 5 6 March 2019 Mark Silberstein, Technion 9
Speculative execution 101 Instruction stream Completed instructions Slow CPU 1 T slow 2 3 Execute Retire 4 5 Executed speculatively 6 March 2019 Mark Silberstein, Technion 10
Speculative execution 101 Instruction stream Completed instructions CPU 1 T slow 2 3 Execute Retire 5 4 Not committed yet! 6 March 2019 Mark Silberstein, Technion 11
Speculative execution 101 Instruction stream Completed instructions CPU 1 T slow 2 3 Execute Retire 5 4 T speculative 6 Only 2 transiently executed instructions fit in the speculation window March 2019 Mark Silberstein, Technion 12
Speculative execution 101 Instruction stream Completed instructions CPU Completed, speculation 1 was right 2 3 Execute Retire 5 4 6 March 2019 Mark Silberstein, Technion 13
Speculative execution 101 Instruction stream Completed instructions CPU 1 2 Execute Retire 3 6 4 5 Commit all pending instructions March 2019 Mark Silberstein, Technion 14
Speculative execution 101 Instruction stream Completed instructions CPU Completed, speculation 1 was wrong 2 3 Execute Retire 5 4 6 March 2019 Mark Silberstein, Technion 15
Speculative execution 101 Instruction stream Completed instructions CPU 1 2 Execute Retire 3 4 5 6 6 Roll back architectural speculative state and continue execution March 2019 Mark Silberstein, Technion 16
Prerequisites to speculative execution attack ● CPU speculates insecurely ● Speculative state cannot be rolled back: data leak ● Race condition: roll back vs. leaking logic – Attack succeeds only if T speculative <T slow access March 2019 Mark Silberstein, Technion 17
Complete example (Rogue cache read – aka Meltdown) Instruction stream Access generates Transient exception instructions movb (kernel secret), %al 3 4 leak( %al) March 2019 Mark Silberstein, Technion 18
Complete example (Rogue cache read – aka Meltdown) Instruction stream Slow: illegal access to an inaccessible address triggers exception that requires long time to resolve movb (secret),%al Execute Retire leak ( %al) March 2019 Mark Silberstein, Technion 19
Complete example (Rogue cache read – aka Meltdown) Instruction stream movb (secret),%al Execute Retire leak(%al) (secret) is insecurely speculated: read from cache or DRAM ignoring page protection March 2019 Mark Silberstein, Technion 20
Complete example (Rogue cache read – aka Meltdown) Instruction stream movb (secret),%al Execute Retire leak(%al) Need to be fast to finish before the exception is resolved March 2019 Mark Silberstein, Technion 21
Complete example (Rogue cache read – aka Meltdown) Instruction stream Exception movb (secret),%al Execute Retire leak ( %al) Speculative state is cleaned except for the one leaked March 2019 Mark Silberstein, Technion 22
Recipe: Speculative read attacks ● P rovoke insecure speculation ● W in the race ● N otify the attacker March 2019 Mark Silberstein, Technion 23
Question 1: where does insecure speculation occur? ● Meltdown: exception due to access to a page with Supervisor bit March 2019 Mark Silberstein, Technion 24
Question 1: where does insecure speculation occur? ● Meltdown: exception due to access to a page with Supervisor bit ● Spectre V1: mis-speculated branch March 2019 Mark Silberstein, Technion 25
Question 1: where does insecure speculation occur? ● Meltdown: exception due to access to a page with Supervisor bit ● Spectre V1: mis-speculated branch ● Foreshadow/L1TF: exception due to access to a non-present page , or via an incorrect mapping March 2019 Mark Silberstein, Technion 26
Question 1: where does insecure speculation occur? ● Meltdown: exception due to access to a page with Supervisor bit ● Spectre V1: mis-speculated branch ● Foreshadow/L1TF: exception due to access to a non-present page , or via an incorrect mapping The data is speculatively fetched from cache/memory violating protection guarantees (OS/program) March 2019 Mark Silberstein, Technion 27
Question 2: How to avoid misspeculation rollback? ● Not all μarch state can be rolled back ● μarch state becomes architecturally visible! – Caches – Branch predictors – Performance counters – Contention on shared resources ● Simplest: cache covert channel (Metldown/Spectre) March 2019 Mark Silberstein, Technion 28
Flush-Reload covert channel ● Flush the cache before the attack ● Sender/receiver: declare char leak_array[4K*256] ● Sender: void leak_byte(char secret) { leak_array[4K*secret]=1; } ● Receiver: probe the array to identify cached values – argmin (access_time(leak_array[4K*i])) March 2019 Mark Silberstein, Technion 29
Question 3: How to win the leak-to-rollback race condition ● Access to leak_array must be fast (in TLB) ● Access to secrets must be fast (in cache) ● Try many times – suppress the exception bailout ● Unsuccessful attempts are zero-biased March 2019 Mark Silberstein, Technion 30
Question 3: How to win the leak-to-rollback race condition ● Access to leak_array must be fast (in TLB) ● Access to secrets must be fast (in cache) ● Try many times – suppress the exception bailout ● Unsuccessful attempts are zero-biased Plus some secret sauce that nobody really Plus some secret sauce that nobody really understands why it works understands why it works March 2019 Mark Silberstein, Technion 31
Agenda ● Background on SGX ● Foreshadow ● Collateral damage on SGX ● Foreshadow-NG /L1TF ● Discussion March 2019 Mark Silberstein, Technion 32
Background: SGX ● Enclave: reversed sandbox ● Private code & data Application – Confidentiality Enclave Enclave – Integrity – Freshness ● Defends against privileged SW! Operating system ● HW acceleration ● Scales with CPU scaling March 2019 Mark Silberstein, Technion 33
Background: SGX memory DRAM encrypted, cache in plain text System memory CPU secret_foo(): ... SGX *p = 1; memory Enclave CPU Plain text data Cache Enclave Page Cache (EPC) March 2019 Mark Silberstein, Technion 34
Background: Address translation in enclaves Enclave System memory secret_foo(): ... *p = 1; EPC Hardware Address translation Page table OS March 2019 Mark Silberstein, Technion 35
Background: SGX abort page semantics Process System memory foo(): ... printf(*p) ; EPC Hardware Address translation Page table OS March 2019 Mark Silberstein, Technion 36
Background: SGX abort page semantics Process System memory foo(): ... printf(*p) ; EPC Hardware Address translation read 0xFF Page table OS March 2019 Mark Silberstein, Technion 37
Process System memory foo(): ... printf(*p) ; EPC Hardware Address translation Page table Foreshadow uses speculative execution to leak secrets from OS SGX secure memory (EPC) March 2019 Mark Silberstein, Technion 38
Agenda ● Foreshadow ● Collateral damage on SGX ● Foreshadow-NG /L1TF ● Discussion March 2019 Mark Silberstein, Technion 39
Reminder: Speculative read attacks ● P rovoke insecure speculation ● W in the race ● N otify the attacker March 2019 Mark Silberstein, Technion 40
Recommend
More recommend
