2019 · 155 citations · 7 references
ComputingComputer EngineeringComputer ScienceComputer SecurityOperating SystemsSecurity ArchitectureKernel DesignMicroarchitectural SecurityOperating System VulnerabilitiesSide-channel AnalysisSide-channel AttacksSpeculative ExecutionCache Side-channel AttacksCode Reuse AttacksInformation DisclosureMeltdown AttacksMicroarchitectural Side-channel AttacksSpectre AttacksSpeculative Execution AttacksTrusted Execution Environments
Spectre, Meltdown, and related attacks expose kernels, hypervisors, trusted execution environments, and browsers to information disclosure via micro‑architectural weaknesses, yet it remains unclear how other applications, especially those not loading attacker code, are affected or how dependent these attacks are on cache‑based side channels. The authors propose SMoTherSpectre, a speculative code‑reuse attack that uses port‑contention in multi‑threaded processors as a side channel to exfiltrate data from a victim process. SMoTher is a fine‑grained side channel that detects contention from a single victim instruction, and the authors develop a methodology and tool to locate SMoTher‑gadgets in popular libraries. Evaluation on glibc uncovered hundreds of exploitable gadgets, and proof‑of‑concept attacks against OpenSSH and an OpenSSL‑based application demonstrated oracles capable of revealing host key bits and plaintext bits via libcrypto and glibc gadgets.
Spectre, Meltdown, and related attacks have demonstrated that kernels, hypervisors, trusted execution environments, and browsers are prone to information disclosure through micro-architectural weaknesses. However, it remains unclear as to what extent other applications, in particular those that do not load attacker-provided code, may be impacted. It also remains unclear as to what extent these attacks are reliant on cache-based side channels. We introduce SMoTherSpectre, a speculative code-reuse attack that leverages port-contention in simultaneously multi-threaded processors (SMoTher) as a side channel to leak information from a victim process. SMoTher is a fine-grained side channel that detects contention based on a single victim instruction. To discover real-world gadgets, we describe a methodology and build a tool that locates SMoTher-gadgets in popular libraries. In an evaluation on glibc, we found hundreds of gadgets that can be used to leak information. Finally, we demonstrate proof-of-concept attacks against the OpenSSH server, creating oracles for determining four host key bits, and against an application performing encryption using the OpenSSL library, creating an oracle which can differentiate a bit of the plaintext through gadgets in libcrypto and glibc.
7
IEEE Software · 2011 · 2K citations
Cross-VM side channels and their use to extract private keys
Yinqian Zhang, Ari Juels, Michael K. Reiter et al. · 2012 · 785 citations
Practical Timing Side Channel Attacks against Kernel Space ASLR
Ralf Hund, Carsten Willems, Thorsten Holz · 2013 · 400 citations · Full text