Earlier this week, researchers released new proof-of-concept attacks against Intel CPUs, including those using the specialized SGX enclave designed to prevent these sorts of problems. Yesterday, news broke of a new attack against ARM CPUs. Let’s round it all up:
First up, Intel. Side-channel attacks are truly the gift that keeps on giving, as researchers continue to build on previous work. These attacks are impossible to completely prevent. But Intel’s CPUs have proven more vulnerable than those of its competitors, though some of this may be due to the amount of attention focused on the company as opposed to ARM or AMD. As the dominant player in the server market, Intel CPUs are exposed to risks in a variety of markets that AMD and ARM CPUs have minimal (but growing) exposure to.
The new SGX attacks, dubbed SGAxe and CrossTalk, are able to penetrate the SGX enclave, though they both assume the system has already been compromised. While this is a tall bar, as Ars Technica points out, it’s also the use-case SGX literally contemplates and is intended to protect against. This time around, the attacks have managed to extract specific data — on the left, below, is an image of the Mona Lisa loaded into Intel SGX, while the right-hand image shows the results of the team’s attempt to recover the data:
CrossTalk, meanwhile, takes advantage of a hidden feature in Intel CPUs known as a staging buffer, which is used to store retired instructions from all CPU cores, including incredibly sensitive instructions like RDRAND and RDSEED. This buffer can even be leveraged to launch cross-core attacks, which wasn’t previously thought to be possible with Hyper-Threading disabled. Obtain the random numbers generated by these instructions and you’re well on your way to guessing the encryption key being used to secure data.
Intel’s fix for CrossTalk is to lock the memory bus before updating the staging buffer and to unlock it only after the buffer is clear. That’s a rather drastic approach, so Intel is enabling it only on a few instructions. Again, these attacks are unlikely to matter to most end-users, but they could concern data centers and cloud deployments. To date, to the best of our knowledge, none of the attacks discussed in various statements on Spectre and Meltdown have been deployed in real-life.
Meanwhile, on the ARM side of things, there’s news of an unnamed side-channel bug that affects these CPUs. Google’s SafeSide project found this bug, and ARM is releasing a workaround for it. In certain circumstances, it is possible to trick an ARM CPU into continuing to execute past what should be a change in control flow. This is known as Straight Line Speculation, and it can be exploited to help leak data out of the CPU. ARM’s proposed fix is to insert speculation barrier sequences immediately after certain unconditional control flow changes. There’s an extensive whitepaper available from the company.
According to ARM, the security risk is low, the issue is difficult to exploit in practice, and no practical exploit has been demonstrated.
Finally, just in case you were unhappy that AMD had been left out, there’s a new group of x86-64 patches going into Linux to fix problems with the OS’s speculative execution mitigation procedures, Phoronix reports. In one case, AMD’s CPU performance was being unintentionally degraded due to how the fixes were applied.
The ARM fixes are not expected to have a performance impact, while the performance impact of the Intel fixes has not been characterized or stated, as far as I can tell. Intel hasn’t completely fixed SGAxe or a related flaw, CacheOut, though its microcode updates are intended to limit the relevance and applicability of these attacks. Researchers and Intel appear to differ on exactly how mitigated the attacks are.
Several years after Spectre and Meltdown, we have a situation in which Intel CPUs continue to be the primary targets of side-channel research. It is not clear to what degree AMD and ARM chips have been protected by less security research focus as opposed to better intrinsic security. It is not clear that any of these attacks will ever be used in a real-world event.
It is not clear, in other words, to what degree you should consider these disclosures relevant to your CPU purchases. My own opinion is that the degree of risk in the consumer market is currently extremely limited, but since some of the security fixes have also had performance impacts, there’s an ongoing need to evaluate how Intel and AMD CPUs behave with these fixes applied.
Now Read:
- Security Disclosures on Theoretical Intel CPU Flaws Are Becoming Ridiculous
- Security Flaw Detected in AMD CPUs Going Back to 2011
- Intel Has an Unfixable Chipset Security Flaw. Is it a Risk?
No comments:
Post a Comment