Medusa: Microarchitectural Data Leakage via Automated Attack - - PowerPoint PPT Presentation

▶
medusa
SMART_READER_LITE
LIVE PREVIEW

Medusa: Microarchitectural Data Leakage via Automated Attack - - PowerPoint PPT Presentation

Aug 01, 2023 495 likes •1.15k views

Medusa: Microarchitectural Data Leakage via Automated Attack Synthesis Daniel Moghimi Moritz Lipp Berk Sunar Michael Schwarz 2018: Meltdown Attack? 2 2018: Meltdown Attack? Virtual Address Space User Space CPU Registers

slide-1
SLIDE 1

Medusa:

Microarchitectural Data Leakage via Automated Attack Synthesis

  • Daniel Moghimi
  • Moritz Lipp
  • Berk Sunar
  • Michael Schwarz
slide-2
SLIDE 2

2018: Meltdown Attack?

2

slide-3
SLIDE 3

2018: Meltdown Attack?

3

0xf…81a0123

P A S S W O R D

Virtual Address Space

User Space Kernel Space 256 different CPU Cache Line CPU Registers

slide-4
SLIDE 4

2018: Meltdown Attack?

0xf…81a0123 P A S S W O R D Virtual Address Space

User Space Kernel Space

Oracle

256 different CPU Cache Line CPU Registers

4

slide-5
SLIDE 5

2018: Meltdown Attack? (Step 1)

0xf…81a0123 P A S S W O R D Virtual Address Space

User Space Kernel Space

Oracle

256 different CPU Cache Line CPU Registers

5

slide-6
SLIDE 6

2018: Meltdown Attack? (Step 1)

0xf…81a0123 P A S S W O R D Virtual Address Space

User Space Kernel Space

Oracle

256 different CPU Cache Line CPU Registers

P 6

slide-7
SLIDE 7

2018: Meltdown Attack? (Step 2)

0xf…81a0123 P A S S W O R D Virtual Address Space

User Space Kernel Space

Oracle

256 different CPU Cache Line CPU Registers

P 7

slide-8
SLIDE 8

2018: Meltdown Attack? (Step 2)

0xf…81a0123 P A S S W O R D Virtual Address Space

User Space Kernel Space

Oracle

256 different CPU Cache Line CPU Registers

Fault Fault

8

slide-9
SLIDE 9

2018: Meltdown Attack? (Step 3)

0xf…81a0123 P A S S W O R D Virtual Address Space

User Space Kernel Space

Oracle

256 different CPU Cache Line CPU Registers F+R

9

slide-10
SLIDE 10

2018: Meltdown Attack? (Step 3)

0xf…81a0123 P A S S W O R D Virtual Address Space

User Space Kernel Space

Oracle

256 different CPU Cache Line CPU Registers F+R

10

slide-11
SLIDE 11

2018: Meltdown Attack? (Step 3)

0xf…81a0123 P A S S W O R D Virtual Address Space

User Space Kernel Space

Oracle

256 different CPU Cache Line CPU Registers F+R

11

slide-12
SLIDE 12

2018: Meltdown Attack? (Step 3)

P A S S W O R D

Virtual Address Space

User Space Kernel Space

Oracle

256 different CPU Cache Line CPU Registers

‘P’ = 0x50

12

slide-13
SLIDE 13

Microarchitecture Data Sampling (MDS)

  • Meltdown is fixed but you can still leak on the fix hardware.
  • Which part of the CPU leak the data?!
  • Why does it leak?

13 whatever

slide-14
SLIDE 14

CPU Memory Subsystem – Leaky Buffers

14 14 14

VFN PFN VFN PFN VFN PFN … …. Offset Offset Offset … DATA DATA DATA …

Load Buffer

VFN PFN [8:0] VFN PFN [8:0] VFN PFN [8:0] … …. Offset Offset Offset … DATA DATA DATA …

Store Buffer

L1

Fill Buffer DTLB

DRAM L3 L2 Memory Subsystem

MFBDS MSBDS MLPDS L1TF

slide-15
SLIDE 15

15

Memory Access

Canonical #GP

Offset VFN

Virtual Address

slide-16
SLIDE 16

16

Memory Access

Canonical #GP TLB

Y

PMH Perm.

Y

P

RW US A …

Physical Page Number

… …

PTE

Offset VFN

Virtual Address

slide-17
SLIDE 17

17

Memory Access

Canonical #GP TLB

Y

PMH Perm.

Y

Present

Y

#PF

P RW US A …

Physical Page Number

… …

PTE

Offset VFN

Virtual Address

slide-18
SLIDE 18

18

Memory Access

Canonical #GP TLB

Y

PMH Perm.

Y

Present

Y

#PF Accessed

Y

Set A Bit

P RW US A …

Physical Page Number

… …

PTE

Offset VFN

Virtual Address

slide-19
SLIDE 19

19

Memory Access

Canonical #GP TLB

Y

PMH Perm.

Y

Present

Y

#PF Accessed

Y

Set A Bit Aligned Vector

Y

P RW US A …

Physical Page Number

… …

PTE

Offset VFN

Virtual Address

#GP

slide-20
SLIDE 20

20

Memory Access

Canonical #GP TLB

Y

PMH Perm.

Y

Present

Y

#PF Accessed

Y

Set A Bit Aligned Vector

Y

P RW US A …

Physical Page Number

… …

PTE

Offset VFN

Virtual Address

#GP Cache Aligned Split Cache

Y

Cached

Y

Cache Miss Handler False Store Dep.

Y

Hazard Recovery TSX Failure

Y #RTM

slide-21
SLIDE 21

Challenges with MDS Testing?

  • Reproducing attacks is not reliable. It may depend on:
  • massaging the pipeline with other instructions
  • CPU configuration (generation, frequency, microcode patch and etc)

21

slide-22
SLIDE 22

Challenges with MDS Testing?

  • Reproducing attacks is not reliable. It may depend on:
  • massaging the pipeline with other instructions
  • CPU configuration (generation, frequency, microcode patch and etc)
  • No public tool to find new variants or to verify hardware patches:
  • Too many things to test (Addressing mode, cache state, assists, and faults)
  • Previous POCs may not work after MC update, but what does it mean?

22

slide-23
SLIDE 23

Challenges with MDS Testing?

  • Reproducing attacks is not reliable. It may depend on:
  • massaging the pipeline with other instructions
  • CPU configuration (generation, frequency, microcode patch and etc)
  • No public tool to find new variants or to verify hardware patches:
  • Too many things to test (Addressing mode, cache state, assists, and faults)
  • Previous POCs may not work after MC update, but what does it mean?
  • Impossible to quantify the impact of leakage:
  • We should care about leakage rate and what data is leaked.
  • My POC is faster than your POC!!

23

slide-24
SLIDE 24

24

Transynther

slide-25
SLIDE 25

Transynther (Fuzzing-based Random MDS Testing)

25

Step 1: Step 2: Step 3:

256 different CPU Cache Line

‘P’ = 0x50

slide-26
SLIDE 26

Transynther (Fuzzing-based Random MDS Testing)

26

Canonical TLB Perm. Present Accessed Aligned Vector Cache Aligned Cached False Store Dep. TSX Failure

Step 1: Step 2: Step 3:

256 different CPU Cache Line

‘P’ = 0x50

slide-27
SLIDE 27

Transynther (Fuzzing-based Random MDS Testing)

27

Canonical TLB Perm. Present Accessed Aligned Vector Cache Aligned Cached False Store Dep. TSX Failure

Step 1: Step 2: Step 3:

256 different CPU Cache Line

‘P’ = 0x50

Step 0: Buffer Grooming

Stores Same Thread: 0x41424344 Stores Hyper Thread: 0x61626364 Loads Same Thread: 0x51525354 Loads Hyper thread Thread: 0x71727374

slide-28
SLIDE 28

Transynther (Fuzzing-based Random MDS Testing)

28

Canonical TLB Perm. Present Accessed Aligned Vector Cache Aligned Cached False Store Dep. TSX Failure

Step 1: Step 2: Step 3:

256 different CPU Cache Line

‘P’ = 0x50

Stores Same Thread: 0x41424344 Stores Hyper Thread: 0x61626364 Loads Same Thread: 0x51525354 Loads Hyper thread Thread: 0x71727374

Step 0: Buffer Grooming

slide-29
SLIDE 29

Transynther (Fuzzing-based MDS Testing)

29

slide-30
SLIDE 30

Transynther (Fuzzing-based MDS Testing)

30

slide-31
SLIDE 31

Transynther (Fuzzing-based MDS Testing)

31

slide-32
SLIDE 32

32

slide-33
SLIDE 33

33

slide-34
SLIDE 34

MDS Attacks - Insights

  • Almost any exception/assist can leak from any buffer
  • The CPU must flush the pipeline before executing an assist.
  • Upon an Exception/Fault/Assist on a Load, Intel CPUs:
  • Execute the load until the last stage.
  • Flush the pipeline at the retirement stage (Cheap Recovery Logic).
  • Continue the load with some data to reach the retirement stage.
  • Which data? (Fill buffer, Store Buffer, Load Buffer)
  • Which one will be leaked first? (First come first serve)

34

slide-35
SLIDE 35

35

slide-36
SLIDE 36

Medusa Attack

  • Medusa only leaks the Write Combining Data
  • Implicit WC, i.e., ‘rep mov’, ‘rep sto’, can be leaked.
  • Memory Copy Routines
  • File IO
  • Served by a Write Combining Buffer (or just the the Fill Buffer).
  • Advantages:
  • Prefiltered data
  • Less Noise
  • More targeted

36

slide-37
SLIDE 37

Medusa Attack – V1 Cache Indexing

37 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index

An invalid (Non-canon) address: 0x5550000000000008-20 Faulty Load

slide-38
SLIDE 38

Medusa Attack – V1 Cache Indexing

38 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index

An invalid (Non-canon) address: 0x5550000000000008-20 Faulty Load

slide-39
SLIDE 39

Medusa Attack – V1 Cache Indexing

39 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index

An invalid (Non-canon) address: 0x5550000000000008-20 Faulty Load

slide-40
SLIDE 40

Medusa Attack – V1 Cache Indexing

40 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index Common Data Bus?!

slide-41
SLIDE 41

Medusa Attack – V2 Unaligned S2L Forwarding

41 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index

Faulty Load

slide-42
SLIDE 42

Medusa Attack – V2 Unaligned S2L Forwarding

42 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index

Faulty Load

YMMx

REPMOV on the Hyper thread: ABCDEFGH IJKLMNOP QRSTUVWX YZ…

slide-43
SLIDE 43

Medusa Attack – V2 Unaligned S2L Forwarding

43 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index

Faulty Load

YMMx

8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index

Store REPMOV on the Hyper thread: ABCDEFGH IJKLMNOP QRSTUVWX YZ…

slide-44
SLIDE 44

Medusa Attack – V2 Unaligned S2L Forwarding

44 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index

Faulty Load

YMMx

8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index

Store REPMOV on the Hyper thread: ABCDEFGH IJKLMNOP QRSTUVWX YZ…

slide-45
SLIDE 45

Medusa Attack – V2 Unaligned S2L Forwarding

45 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index

Faulty Load

YMMx

8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte 8-byte

Cache Line Index

Store REPMOV on the Hyper thread: ABCDEFGH IJKLMNOP QRSTUVWX YZ…

slide-46
SLIDE 46

Medusa Attack – V3 Shadow REP MOV

46

  • A REP MOV that fault on the load leaks:
  • the data from the legitimate store address
  • but also the data from the REP MOV running on the hyper thread

AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA

HT 1: REP MOV Valid Store, Faulty Load

ABCDEFGHIJKLMNOP AAAAAAAAAAAAAAAA

HT 1: REP MOV Valid Store, Faulty Load

slide-47
SLIDE 47

Medusa Attack – V3 Shadow REP MOV

47

  • A REP MOV that fault on the load leaks:
  • the data from the legitimate store address
  • but also the data from the REP MOV running on the hyper thread

AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA

HT 1: REP MOV Valid Store, Faulty Load

ABCDEFGHIJKLMNOP AAAAAAAAAAAAAAAA

HT 1: REP MOV Valid Store, Faulty Load

AAAAAAAAAAAIIAAAIAIAAAIAIAIIIAAAAAA…

slide-48
SLIDE 48

48

slide-49
SLIDE 49

OpenSSL RSA Key Recovery

49

  • OpenSSL Base64 Decoder uses inline Memcpy(-oS)
  • Triggered during the RSA Key Decoding from the PEM format:
  • ----BEGIN RSA PRIVATE KEY-----

MIICXQIBAAKBgQDmTvQjjtGtnIqMwmmaLW+YjbYTsNR8PGKXr78iYwrMV5Ye4VGy BwS6qLD4s/EzCzGIDwkWCVx+gVHvh2wGW15Ddof0gVAtAMkR6gRABy4TkK+6YFSK AyjmHvKCfFHvc9loeFGDyjmwFFkfdwzppXnH1Wwt0OlnyCU1GbQ1w7AHuwIDAQAB AoGBAMyDri7pQ29NBIfMmGQuFtw8c0R3EamlIdQbX7qUguFEoe2YHqjdrKho5oZj nDu8o+Zzm5jzBSzdf7oZ4qaeekv0fO+ZSz6CKYLbuzG2IXUB8nHJ7NuH3lacfivD V4Cfg0yFnTK+MDG/xTVqywrCTsslkTCYC/XZOXU5Xt5z32FZAkEA/nLWQhMC4YPM 0LqMtgKzfgQdJ7vbr43WVVNpC/dN/ibUASI/3YwY0uUtqSjilIghIY7pRohrPJ6W ntSJw0UAhQJBAOe2b9cfiOTFKXxyU4j315VkulFfTyL6GwXi/7mvpcDCixDLNRyk uRigmdKjtIUrAX0pwjgXa6niqJ691jExez8CQQCcMZZAvTbZhHSn9LwHxqS0SIY1 K+ZxX5ogirFDPS5NQzyE7adSsntSioh6/LQKBX6BAR9FwtxBPACtwz5F9geZAkA8 a3z0SlvG04aC1cjkgUPsx6wxxbl79F2RhmSKRbvh7JiYk3RQ+L7vJgmWPGu5AcLM

  • VPsjmbbkKfJZNTyVOW/AkABepEi++ZQQW0FXJWZ3nM+2CNcXYCtTgi4bGkvnZPp

/1pAy9rjeVJYhb8acTRnt+dU+uZ74CTtfuzUTZLOIuVe

  • ----END RSA PRIVATE KEY-----
slide-50
SLIDE 50

OpenSSL RSA Key Recovery

50

  • OpenSSL Base64 Decoder uses inline Memcpy(-oS)
  • Triggered during the RSA Key Decoding from the PEM format:
  • ----BEGIN RSA PRIVATE KEY-----

MIICXQIBAAKBgQDmTvQjjtGtnIqMwmmaLW+YjbYTsNR8PGKXr78iYwrMV5Ye4VGy BwS6qLD4s/EzCzGIDwkWCVx+gVHvh2wGW15Ddof0gVAtAMkR6gRABy4TkK+6YFSK AyjmHvKCfFHvc9loeFGDyjmwFFkfdwzppXnH1Wwt0OlnyCU1GbQ1w7AHuwIDAQAB AoGBAMyDri7pQ29NBIfMmGQuFtw8c0R3EamlIdQbX7qUguFEoe2YHqjdrKho5oZj nDu8o+Zzm5jzBSzdf7oZ4qaeekv0fO+ZSz6CKYLbuzG2IXUB8nHJ7NuH3lacfivD V4Cfg0yFnTK+MDG/xTVqywrCTsslkTCYC/XZOXU5Xt5z32FZAkEA/nLWQhMC4YPM 0LqMtgKzfgQdJ7vbr43WVVNpC/dN/ibUASI/3YwY0uUtqSjilIghIY7pRohrPJ6W ntSJw0UAhQJBAOe2b9cfiOTFKXxyU4j315VkulFfTyL6GwXi/7mvpcDCixDLNRyk uRigmdKjtIUrAX0pwjgXa6niqJ691jExez8CQQCcMZZAvTbZhHSn9LwHxqS0SIY1 K+ZxX5ogirFDPS5NQzyE7adSsntSioh6/LQKBX6BAR9FwtxBPACtwz5F9geZAkA8 a3z0SlvG04aC1cjkgUPsx6wxxbl79F2RhmSKRbvh7JiYk3RQ+L7vJgmWPGu5AcLM

  • VPsjmbbkKfJZNTyVOW/AkABepEi++ZQQW0FXJWZ3nM+2CNcXYCtTgi4bGkvnZPp

/1pAy9rjeVJYhb8acTRnt+dU+uZ74CTtfuzUTZLOIuVe

  • ----END RSA PRIVATE KEY-----
slide-51
SLIDE 51

OpenSSL RSA Key Recovery

51

  • OpenSSL Base64 Decoder uses inline Memcpy(-oS)
  • Triggered during the RSA Key Decoding from the PEM format:

P Q d mod (p-1) d mod (q-1) Q^(-1) mod p N (Modulus) d (Private Key)

slide-52
SLIDE 52

OpenSSL RSA Key Recovery - Coppersmith

52

  • Knowledge of at least Τ

1 3 of P+Q

  • Create a 𝑜 dimensional hidden number problem where 𝑜 is relative

to the number of recovered chunks

  • Feed it to the lattice-based algorithm to find the short vector

P Q

slide-53
SLIDE 53

OpenSSL RSA Key Recovery – Coppersmith Attack

53

  • Knowledge of at least Τ

1 3 of P+Q.

  • Creating a 𝑜 dimensional hidden number problem where 𝑜 is

relative to the number of recovered chunks.

  • Feeding it to the lattice-based algorithm to find the short vector.

P Q Coppersmith P

slide-54
SLIDE 54

Responsible Disclosure

  • Medusa
  • June 24, 2019: Reported initial findings to Intel
  • Intel confirmed that WC is part of the fill buffer, but embargoed due to TAA
  • Nov 12, 2019: $$$ Awarded

54

slide-55
SLIDE 55

Conclusion

  • Automated Testing for CPU Attacks
  • helps us to understand the root cause of these issues better.
  • can be used to verify hardware mitigations.
  • can help us to improve the leakage rate and understand the impact of

attacks better.

  • The impact of attacks depend also on the exploitation technique.

55

slide-56
SLIDE 56

Conclusion

  • Automated Testing for CPU Attacks
  • helps us to understand the root cause of these issues better.
  • can be used to verify hardware mitigations.
  • can help us to improve the leakage rate and understand the impact of

attacks better.

  • The impact of attacks depend also on the exploitation technique.

56

slide-57
SLIDE 57

Conclusion

  • Automated Testing for CPU Attacks
  • helps us to understand the root cause of these issues better.
  • can be used to verify hardware mitigations.
  • can help us to improve the leakage rate and understand the impact of

attacks better.

  • The impact of attacks depend also on the exploitation technique.

57

slide-58
SLIDE 58

Responsible Disclosure (Ice Lake)

  • MSBDS (Fallout) on Ice Lake
  • November 2019: Intel sent us an Ice Lake Machine (Hardware mitigations)

58

slide-59
SLIDE 59

Responsible Disclosure (Ice Lake)

  • MSBDS (Fallout) on Ice Lake
  • November 2019: Intel sent us an Ice Lake Machine
  • March 2019: Tested Transyther on the Ice Lake CPU

59

slide-60
SLIDE 60

Responsible Disclosure (Ice Lake)

  • MSBDS (Fallout) on Ice Lake
  • November 2019: Intel sent us an Ice Lake Machine
  • March 2019: Tested Transyther on the Ice Lake CPU

60

slide-61
SLIDE 61

Responsible Disclosure (Ice Lake)

  • MSBDS (Fallout) on Ice Lake
  • November 2019: Intel sent us an Ice Lake Machine
  • March 2019: Tested Transyther on the Ice Lake CPU
  • Mar 27, 2020: Reported MSBDS Leakage on Ice Lake
  • May 5, 2020: Intel Completed triage
  • MDS mitigations are not deployed properly
  • Chicken bits were not enabled for all mitigations.
  • OEMs shipped with old/wrong microcode.
  • Embargoed till July
  • July 13, 2020: MDS advisory and list of affected CPUs were updated.
  • $$$ Awarded

61

slide-62
SLIDE 62

62

slide-63
SLIDE 63

Questions?!

63 https://github.com/ VernamLab/Medusa https://github.com/ danielmgmi/IceBreak