Attacking X86 Processor Integrity from Software
Total Page：16
File Type：pdf, Size：1020Kb
V0LTpwn: Attacking x86 Processor Integrity from Software Zijo Kenjar and Tommaso Frassetto, Technische Universität Darmstadt; David Gens and Michael Franz, University of California, Irvine; Ahmad-Reza Sadeghi, Technische Universität Darmstadt https://www.usenix.org/conference/usenixsecurity20/presentation/kenjar This paper is included in the Proceedings of the 29th USENIX Security Symposium. August 12–14, 2020 978-1-939133-17-5 Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX. V0LTpwn: Attacking x86 Processor Integrity from Software Zijo Kenjar1, Tommaso Frassetto1, David Gens2, Michael Franz2, and Ahmad-Reza Sadeghi1 1Technical University of Darmstadt, Germany {zijo.kenjar,tommaso.frassetto,ahmad.sadeghi}@trust.tu-darmstadt.de 2University of California, Irvine {dgens,franz}@uci.edu Abstract complex, and far from flawless. In the recent past, we Fault-injection attacks have been proven in the past to have seen how seemingly minor implementation bugs at be a reliable way of bypassing hardware-based security the hardware level can have a severe impact on secu- measures, such as cryptographic hashes, privilege and rity [14]. Attacks such as Meltdown [36], Spectre [33], access permission enforcement, and trusted execution Foreshadow [58], and RIDL [62] demonstrate that at- environments. However, traditional fault-injection at- tackers can exploit these bugs from software to bypass tacks require physical presence, and hence, were often access permissions and extract secret data. considered out of scope in many real-world adversary Furthermore, we have seen that the adverse effects settings. of hardware vulnerabilities are not limited to confiden- In this paper we show this assumption may no longer tiality, but can also compromise integrity in principle: be justified on x86. We present V0LTpwn, a novel the infamous Rowhammer bug [32] resulted in numer- hardware-oriented but software-controlled attack that ous exploits [6, 24, 43, 48, 50, 56, 60, 63, 65] leveraging bit affects the integrity of computation in virtually any ex- flips in flawed DRAM modules, which are deployed on ecution mode on modern x86 processors. To the best practically all computer systems today. While initial of our knowledge, this represents the first attack on defenses have been proposed to mitigate Rowhammer the integrity of the x86 platform from software. The from software [5,8], fixing Rowhammer bugs ultimately key idea behind our attack is to undervolt a physical requires deploying new hardware. core to force non-recoverable hardware faults. Under With recent feature sizes shrinking to single-digit a V0LTpwn attack, CPU instructions will continue to nanometer scale, semiconductor companies face the grow- execute with erroneous results and without crashes, al- ing problem of the so-called dark silicon. At run time lowing for exploitation. In contrast to recently presented large parts of the chip will have to be left powered-off, side-channel attacks that leverage vulnerable speculative since the billions of transistors cannot be operated within execution, V0LTpwn is not limited to information dis- the thermal constraints and power budget the platform closure, but allows adversaries to affect execution, and was originally designed for. This prevented hardware hence, effectively breaks the integrity goals of modern designers from leveraging Dennard scaling [17,53]; conse- x86 platforms. In our detailed evaluation we success- quently, manufacturers have moved to more intelligent, fully launch software-based attacks against Intel SGX on-demand thermal and voltage control on recent plat- enclaves from a privileged process to demonstrate that forms. This means that critical operational aspects of a V0LTpwn attack can successfully change the results of the processor can now and are increasingly controlled computations within enclave execution across multiple from software during run time. Unfortunately, this de- CPU revisions. velopment comes with severe consequences for computer security. 1 Introduction In 2017 Tang et al. [55] showed that the intricacies of low-level and fine-grained power management on ARM- Modern hardware platforms have a long history that based mobile devices open up serious pitfalls, as they spans multiple decades. The need to ensure backwards were able to induce faults in the processor of a Nexus 6 compatibility and the constant tweaking of existing de- smartphone, allowing them to bypass the isolation bound- signs has burdened widely deployed hardware architec- ary of TrustZone. So far, a similar scenario was deemed tures with legacy components that have become highly unlikely on x86-based systems for several reasons: (i) x86- USENIX Association 29th USENIX Security Symposium 1445 based power management traditionally does not expose reproducible faults in our tests. For this, we leverage direct access to hardware regulators to software above undocumented features, extending and customizing the the BIOS level, (ii) desktops and servers are typically available software tools to enable detailed probing and not battery powered, and hence, feature less aggressive attacks on real-world code. Our findings show that the and more coarse-grained power management, and finally deployed defenses (MCA, SGX isolation) are insufficient (iii) x86-based platforms deploy extensive safety measures in practice, leaving a large number of real-world system and implement strict architectural defenses to prevent, vulnerable to V0LTpwn. detect, and recover from hardware faults at run time. To summarize, our contributions include the following: We elaborate on the differences between our work and previous attacks in Section8. • Novel attack against x86 processors: we In this paper, we present V0LTpwn, the first software- present V0LTpwn, the first software-controlled fault- controlled fault-injection attack for x86-based platforms injection attack for the x86 platform. Through (together with concurrent work [38,45]). Our attack is targeted undervolting from malicious software able to directly affect processor execution regardless of V0LTpwn is able to alter computational results and privilege level, execution mode, or hardware isolation. affect processor execution in victim software at run As a result, V0LTpwn is also able to compromise the time. We introduce several new techniques, such integrity guarantees of Intel’s Software Guard Exten- as identifying fault-susceptible frequency settings, sions (SGX). SGX is a hardware security extension instruction patterns, and stressing the logical part- which Intel promotes in cloud-based scenarios where ner core to increase temperature and resource con- cloud providers should be considered untrusted [27]. tention while undervolting. The key idea behind our V0LTpwn attack is to un- • Real-world impact and responsible disclo- dervolt the physical target core that executes the victim sure: we confirmed reproducible and exploitable software (i.e., reduce its available voltage). We achieve faults for code running within user processes, ker- this by exploiting software-exposed but obscure power- nel code, and SGX enclaves. Intel confirmed our management interfaces of modern x86 platforms. We findings and proof-of-concept attack, assigned a analyze a number of CPUs of different Intel generations CVE [57], issued an advisory [30], and released a and we show that all of them are prone to fault-injection microcode update. attacks despite deploying dedicated counter measures. In particular, all of these processors feature an elaborate • Extensive evaluation and proof-of-concept set of management and safety mechanisms collectively implementation: we implement and demonstrate called Machine-Check Architecture (MCA) [28], provid- an end-to-end exploit against recent processors that ing detection and fallback routines for handling critical support SGX, which is designed as a completely iso- hardware events such as core, uncore, interconnect, bus, lated and trusted execution environment in the pres- parity, and cache errors. ence of potentially malicious software running on Processors leverage a number of model-specific regis- the platform. By undervolting the processor while ters to control and report such events across different the SGX enclave runs we are able to manipulate hardware layers. These events can then be forwarded as its execution at run time and demonstrate manip- machine-check exceptions to software handlers to store, ulation of computation through software-induced process, and react to critical failures. However, we show faults. Our results show that we are able to induce that an adversary can still inject exploitable hardware and exploit faults on multiple processors of differ- faults by carefully driving processor execution into un- ent micro-architectures despite extensive defensive stable voltage domains. We construct a proof-of-concept measures to prevent, detect, and recover from such exploit in which the attacker injects such faults into a errors. running SGX enclave entirely from software. We analyze, conduct, and evaluate this new attack through a number of tests across multiple Intel CPUs. 2 Background Contrary to recent hardware-oriented attacks such as Foreshadow [58], Spectre [33], RIDL [62] and Melt- In this section we explain the background information down [36] — which are limited to extracting information required for the understanding of the rest of the paper. through side channels — our attack enables an adver- First, we describe the principles of power management sary to manipulate