Foreshadow: Extracting the Keys to the Intel SGX Kingdom with - - PowerPoint PPT Presentation

▶
foreshadow extracting the keys to the intel sgx kingdom
SMART_READER_LITE
LIVE PREVIEW

Foreshadow: Extracting the Keys to the Intel SGX Kingdom with - - PowerPoint PPT Presentation

Sep 08, 2022 41 likes •607 views

Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution Jo Van Bulck 1 Marina Minkin 2 Ofir Weisse 3 Daniel Genkin 3 Baris Kasikci 3 Frank Piessens 1 Mark Silberstein 2 Thomas F. Wenisch 3 Yuval Yarom 4 Raoul

slide-1
SLIDE 1

Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution

Jo Van Bulck 1 Marina Minkin 2 Ofir Weisse 3 Daniel Genkin 3 Baris Kasikci 3 Frank Piessens 1 Mark Silberstein 2 Thomas F. Wenisch 3 Yuval Yarom 4 Raoul Strackx 1

1imec-DistriNet, KU Leuven 2Technion 3University of Michigan 4University of Adelaide and Data61

USENIX Security, August 2018

slide-2
SLIDE 2

Road map

1

Introduction

2

The Foreshadow attack

3

Demo

4

Dismantling Intel SGX security objectives

5

Foreshadow-NG implications

6

Mitigations and conclusion

slide-3
SLIDE 3

Evolution of “side-channel attack” occurrences in Google Scholar

1990 1994 1998 2002 2006 2010 2014 2018 3000 4000 2000 1000

DO WE JUST SUCK AT... COMPUTERS?

  • YUP. ESPECIALLY SHARED ONES.

Based on github.com/Pold87/academic-keyword-occurrence and xkcd.com/1938/ 1 / 17

slide-4
SLIDE 4

Security in a post-Meltdown world

Classic attacker-defender race Exploit and patch application-level vulnerabilities (memory safety, side-channels)

App OS CPU

2 / 17

slide-5
SLIDE 5

Security in a post-Meltdown world

Game changer Meltdown Free universal read primitive → kernel page-table isolation

App OS CPU

! ?

2 / 17

slide-6
SLIDE 6

Rumors: Meltdown immunity for SGX enclaves?

“[enclaves] remain protected and completely secure” — International Business Times, February 2018

“[enclave memory accesses] redirected to an abort page, which has no value” — Anjuna Security, Inc., March 2018

3 / 17

slide-7
SLIDE 7

Rumors: Meltdown immunity for SGX enclaves?

https://wired.com and https://arstechnica.com 3 / 17

slide-8
SLIDE 8

Intel SGX promise: Hardware-level isolation and attestation Mem HDD OS kernel

Trusted Untrusted

CPU App App TPM Hypervisor Enclave app

4 / 17

slide-9
SLIDE 9

Intel SGX promise: Hardware-level isolation and attestation Mem HDD OS kernel

Trusted Untrusted

CPU App App TPM Hypervisor Enclave app

4 / 17

slide-10
SLIDE 10
slide-11
SLIDE 11

Road map

1

Introduction

2

The Foreshadow attack

3

Demo

4

Dismantling Intel SGX security objectives

5

Foreshadow-NG implications

6

Mitigations and conclusion

slide-12
SLIDE 12

Building Foreshadow

5 / 17

slide-13
SLIDE 13

Building Foreshadow

L1 terminal fault challenges

5 / 17

slide-14
SLIDE 14

Meltdown recap: Transiently encoding unauthorized memory

Unauthorized access

6 / 17

slide-15
SLIDE 15

Meltdown recap: Transiently encoding unauthorized memory

Unauthorized access Transient out-of-order window

  • racle array

secret idx

6 / 17

slide-16
SLIDE 16

Meltdown recap: Transiently encoding unauthorized memory

Unauthorized access Transient out-of-order window Exception (discard architectural state)

6 / 17

slide-17
SLIDE 17

Meltdown recap: Transiently encoding unauthorized memory

Unauthorized access Transient out-of-order window

  • racle array

cache hit

Exception handler

6 / 17

slide-18
SLIDE 18

Challenge #1: Intel SGX abort page semantics

7 / 17

slide-19
SLIDE 19

Challenge #1: Intel SGX abort page semantics

Untrusted world view Enclaved memory reads 0xFF Intra-enclave view Access enclaved + unprotected memory

7 / 17

slide-20
SLIDE 20

Challenge #1: Intel SGX abort page semantics

Untrusted world view Enclaved memory reads 0xFF Intra-enclave view Access enclaved + unprotected memory SGXpectre in-enclave code abuse

7 / 17

slide-21
SLIDE 21

Challenge #1: Intel SGX abort page semantics

Untrusted world view Enclaved memory reads 0xFF Meltdown “bounces back” (∼ mirror) Intra-enclave view Access enclaved + unprotected memory SGXpectre in-enclave code abuse

7 / 17

slide-22
SLIDE 22

Building Foreshadow: Evade the abort page

Note: SGX MMU sanitizes untrusted address translation

SGX?

Abort page semantics: An attempt to read from a non-existent or disallowed resource returns all ones for data (abort page). An attempt to write to a non-existent or disallowed physical resource is

  • dropped. This behavior is unrelated to exception type abort (the others being Fault and Trap).

https://software.intel.com/en-us/sgx-sdk-dev-reference-enclave-development-basics 8 / 17

slide-23
SLIDE 23

Building Foreshadow: Evade the abort page

Note: SGX MMU sanitizes untrusted address translation

Van Bulck et al. “Telling your secrets without page faults: Stealthy page table-based attacks on enclaved execution”, USENIX Security 2017 8 / 17

slide-24
SLIDE 24

Building Foreshadow: Evade the abort page

Straw man: (Speculative) accesses in non-enclave mode are dropped

Van Bulck et al. “Telling your secrets without page faults: Stealthy page table-based attacks on enclaved execution”, USENIX Security 2017 8 / 17

slide-25
SLIDE 25

Building Foreshadow: Evade the abort page

Stone man: Bypass abort page via untrusted page table

Van Bulck et al. “Telling your secrets without page faults: Stealthy page table-based attacks on enclaved execution”, USENIX Security 2017 8 / 17

slide-26
SLIDE 26

Building Foreshadow: Evade the abort page

Stone man: Bypass abort page via untrusted page table

Unprivileged system call

mprotect( secret_ptr & 0xFFF, 0x1000, PROT_NONE );

Van Bulck et al. “Telling your secrets without page faults: Stealthy page table-based attacks on enclaved execution”, USENIX Security 2017 8 / 17

slide-27
SLIDE 27

Challenge #2: Strict caching requirements

9 / 17

slide-28
SLIDE 28

Challenge #2: Strict caching requirements

L1 terminal fault Only enclave loads served from L1 reach transient out-of-order execution

https://twitter.com/lavados/status/951066835310534656 9 / 17

slide-29
SLIDE 29

Challenge #2: Strict caching requirements

L1 terminal fault Only enclave loads served from L1 reach transient out-of-order execution Foreshadow present bit ↔ Meltdown supervisor bit

9 / 17

slide-30
SLIDE 30

Challenge #2: Strict caching requirements

Intel micro-architecture Address translation abort in parallel with L1 lookup (tag comparison)

SGX? EPT walk? PT walk?

L1D vadrs guest padrs host padrs T ag? Pass to out-of-order CPU micro-architecture EPCM fail

1 2 3

3a

Weisse et al. “Foreshadow-NG: Breaking the Virtual Memory Abstraction with Transient Out-of-Order Execution” 9 / 17

slide-31
SLIDE 31

Building Foreshadow: Loading enclave secrets in L1

SGX-Step

  • 1. Preemptive extraction

Interrupt victim enclave at page or instruction-level granularity → Memory operands + CPU registers (SSA)

Van Bulck et al. “SGX-Step: A practical attack framework for precise enclave execution control”, SysTEX 2017 10 / 17

slide-32
SLIDE 32

Building Foreshadow: Loading enclave secrets in L1

SGX-Step

  • 1. Preemptive extraction

Interrupt victim enclave at page or instruction-level granularity → Memory operands + CPU registers (SSA)

  • 2. Concurrent extraction

Intel HyperThreading: co-resident logical CPUs share L1 → Real time memory accesses

10 / 17

slide-33
SLIDE 33

Building Foreshadow: Loading enclave secrets in L1

SGX-Step

  • 1. Preemptive extraction

Interrupt victim enclave at page or instruction-level granularity → Memory operands + CPU registers (SSA)

  • 2. Concurrent extraction

Intel HyperThreading: co-resident logical CPUs share L1 → Real time memory accesses

  • 3. Uncached extraction

Forcibly reload 4 KiB enclave page: ewb + eldu → Reliably dump entire enclave address space

10 / 17

slide-34
SLIDE 34

Building Foreshadow: Loading enclave secrets in L1

Many more optimization techniques + microbenchmarks → see paper!

10 / 17

slide-35
SLIDE 35

Road map

1

Introduction

2

The Foreshadow attack

3

Demo

4

Dismantling Intel SGX security objectives

5

Foreshadow-NG implications

6

Mitigations and conclusion

slide-36
SLIDE 36

Demo time!

Based on xkcd.com/285/ 11 / 17

slide-37
SLIDE 37

Road map

1

Introduction

2

The Foreshadow attack

3

Demo

4

Dismantling Intel SGX security objectives

5

Foreshadow-NG implications

6

Mitigations and conclusion

slide-38
SLIDE 38

Establishing trust: Remote attestation and secret provisioning

Binding secrets to enclave identity Goal: Secure end-to-end communication channel + local storage

App enclave

12 / 17

slide-39
SLIDE 39

Establishing trust: Remote attestation and secret provisioning

CPU-level key derivation Intel == trusted 3th party (shared CPU master secret)

App enclave

EGETKEY EREPORT

Quoting enclave

Genuine attestation flow

12 / 17

slide-40
SLIDE 40

Eroding trust: Remote attestation and secret provisioning

Foreshadow adversary Extract long-term platform attestation key → forge Intel signatures

App enclave Quoting enclave

Bogus attestation flow

EGETKEY

13 / 17

slide-41
SLIDE 41

Eroding trust: Remote attestation and secret provisioning

Foreshadow domino effects Active man-in-the-middle: read + modify all local and remote secrets (!)

App enclave

13 / 17

slide-42
SLIDE 42

Road map

1

Introduction

2

The Foreshadow attack

3

Demo

4

Dismantling Intel SGX security objectives

5

Foreshadow-NG implications

6

Mitigations and conclusion

slide-43
SLIDE 43

Foreshadow-NG: Breaking the virtual memory abstraction

L1 terminal fault [Int18] Unmap page → read arbitrary cached physical memory

https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault Weisse et al. “Foreshadow-NG: Breaking the Virtual Memory Abstraction with Transient Out-of-Order Execution” 14 / 17

slide-44
SLIDE 44

Foreshadow-NG: Breaking the virtual memory abstraction

SGX? EPT walk? PT walk?

L1D vadrs guest padrs host padrs T ag? Pass to out-of-order CPU micro-architecture EPCM fail

1 2 3

3a

Weisse et al. “Foreshadow-NG: Breaking the Virtual Memory Abstraction with Transient Out-of-Order Execution” 15 / 17

slide-45
SLIDE 45

Road map

1

Introduction

2

The Foreshadow attack

3

Demo

4

Dismantling Intel SGX security objectives

5

Foreshadow-NG implications

6

Mitigations and conclusion

slide-46
SLIDE 46

Mitigating Foreshadow

16 / 17

slide-47
SLIDE 47

Mitigating Foreshadow

Future CPUs (silicon-based changes)

https://newsroom.intel.com/editorials/advancing-security-silicon-level/ 16 / 17

slide-48
SLIDE 48

Mitigating Foreshadow

OS kernel updates (sanitize page frame bits)

Intel SGX: untrusted OS → no software-only mitigations

16 / 17

slide-49
SLIDE 49

Mitigating Foreshadow

Intel microcode updates

⇒ Flush L1 cache on enclave/VMM exit + disable HyperThreading

https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault 16 / 17

slide-50
SLIDE 50

Conclusions and lessons learned

Take-away message Foreshadow == L1 cache read primitive → collapse CPU protection

17 / 17

slide-51
SLIDE 51

Conclusions and lessons learned

Take-away message Foreshadow == L1 cache read primitive → collapse CPU protection ↔ Intel µ-code patches for TCB recovery (+ disable HyperThreading!)

17 / 17

slide-52
SLIDE 52

Conclusions and lessons learned

Take-away message Foreshadow == L1 cache read primitive → collapse CPU protection ↔ Intel µ-code patches for TCB recovery (+ disable HyperThreading!) ⇒ Importance of fundamental side-channel research (e.g., page table attack surface) ⇒ TEE design: avoid single point of failure (domino effects)

17 / 17

slide-53
SLIDE 53

Thank you! Questions?

https://foreshadowattack.eu

slide-54
SLIDE 54

References I

  • G. Chen, S. Chen, Y. Xiao, Y. Zhang, Z. Lin, and T. H. Lai.

Sgxpectre attacks: Leaking enclave secrets via speculative execution. arXiv preprint arXiv:1802.09085, 2018. Intel Corporation. Intel analysis of L1 terminal fault, August 2018. https://software.intel.com/security-software-guidance/insights/deep-dive-intel-analysis-l1-terminal-fault.

  • M. Lipp, M. Schwarz, D. Gruss, T. Prescher, W. Haas, A. Fogh, J. Horn, S. Mangard, P. Kocher, D. Genkin, Y. Yarom, and M. Hamburg.

Meltdown: Reading kernel memory from user space. In 27th USENIX Security Symposium (USENIX Security 18), 2018.

  • J. Van Bulck, F. Piessens, and R. Strackx.

SGX-Step: A practical attack framework for precise enclave execution control. In Proceedings of the 2nd Workshop on System Software for Trusted Execution, SysTEX’17, pp. 4:1–4:6. ACM, 2017.

  • J. Van Bulck, N. Weichbrodt, R. Kapitza, F. Piessens, and R. Strackx.

Telling your secrets without page faults: Stealthy page table-based attacks on enclaved execution. In Proceedings of the 26th USENIX Security Symposium. USENIX Association, August 2017.

  • O. Weisse, J. Van Bulck, M. Minkin, D. Genkin, B. Kasikci, F. Piessens, M. Silberstein, R. Strackx, T. F. Wenisch, and Y. Yarom.

Foreshadow-NG: Breaking the virtual memory abstraction with transient out-of-order execution. Technical Report, 2018.

  • Y. Xu, W. Cui, and M. Peinado.

Controlled-channel attacks: Deterministic side channels for untrusted operating systems. In 36th IEEE Symposium on Security and Privacy. IEEE, May 2015. 18 / 17

slide-55
SLIDE 55

Appendix: Remote attestation

Intel Provisioning Service Intel Quoting Service

Provisioning Enclave Quoting Enclave Application Enclave

Remote Verifier

A B 1 3 2 5 4 7 6

19 / 17

slide-56
SLIDE 56

Appendix: Key derivation

do_egetkey(&tmp); memcpy(&key, &tmp); memset(&tmp, 0x0); free(&tmp); do_egetkey (0x02658) ... enclu[EGETKEY] ... ret sgx_get_key (0x11760) selib (trusted runtime) tmp (0xc6400)

3

key (0xe87b0) le_get_launch_token

5 1 2

sgx_get_key(&key, keyid); sgx_cmac128(&key, token); memset(&key, 0x0);

6 7

return;

4

20 / 17