[论文解读] LazyFP: Leaking FPU Register State using Microarchitectural Side-Channels

Julian Stecklina, Thomas Prescher|arXiv (Cornell University)|Jun 19, 2018

Security and Verification in Computing参考文献 2被引用 66

一句话总结

这篇论文展示了通过滥用延迟FPU上下文切换和微架构侧信道，在跨进程/虚拟机边界泄漏FPU/SIMD寄存器状态的实用攻击，使用基于故障的、基于TSX的，或基于retpoline的异常抑制。

ABSTRACT

Modern processors utilize an increasingly large register set to facilitate efficient floating point and SIMD computation. This large register set is a burden for operating systems, as its content needs to be saved and restored when the operating system context switches between tasks. As an optimization, the operating system can defer the context switch of the FPU and SIMD register set until the first instruction is executed that needs access to these registers. Meanwhile, the old content is left in place with the hope that the current task might not use these registers at all. This optimization is commonly called lazy FPU context switching. To make it possible, a processor offers the ability to toggle the availability of instructions utilizing floating point and SIMD registers. If the instructions are turned off, any attempt of executing them will generate a fault. In this paper, we present an attack that exploits lazy FPU context switching and allows an adversary to recover the FPU and SIMD register set of arbitrary processes or VMs. The attack works on processors that transiently execute FPU or SIMD instructions that follow an instruction generating the fault indicating the first use of FPU or SIMD instructions. On operating systems using lazy FPU context switching, the FPU and SIMD register content of other processes or virtual machines can then be reconstructed via cache side effects. With SIMD registers not only being used for cryptographic computation, but also increasingly for simple operations, such as copying memory, we argue that lazy FPU context switching is a dangerous optimization that needs to be turned off in all operating systems, if there is a chance that they run on affected processors.

研究动机与目标

• 解释延迟FPU上下文切换如何在跨边界时泄漏FPU状态。
• 描述多种复用推测执行来读取FPU/SIMD寄存器的攻击变体。
• 评估不同异常抑制方法的可行性和性能。
• 评估对如AES-NI等密码原语的影响并讨论缓解措施。
• 为操作系统提供通过避免延迟FPU上下文切换来提升安全性的指南。

提出的方法

• 描述延迟FPU上下文切换机制以及#NM异常如何指示FPU被使用。
• 通过利用推测执行和缓存副作用，开发一个比特位泄漏和全寄存器泄漏。
• 提出三种攻击变体：基于页面错误的抑制、基于Intel TSX的抑制，以及基于retpoline的抑制。
• 展示在一个调度时间片内对整个AVX寄存器集合的实际泄漏。
• 分析对AES-NI密钥材料的影响并提供缓解建议。

实验结果

研究问题

• RQ1 是否可以通过推测执行利用延迟FPU上下文切换来恢复受害者的FPU/SIMD寄存器状态？
• RQ2 哪些实用的攻击变体能够抑制或规避操作系统异常处理以泄漏FPU寄存器？
• RQ3 攻击性能如何随不同异常抑制机制（页面错误、TSX、retpoline）而变化？
• RQ4 被泄漏的FPU状态对如AES-NI等密码原语有何影响？

主要发现

• 一个简单的一比特泄漏利用推测执行通过缓存效应推断受害者FPU寄存器的比特。
• 通过页面错误、TSX或retpoline抑制NM故障，使在一个调度时间片内获得FPU状态的完整快照。
• 表格结果显示，使用TSX或retpoline相对于页面错误方法，在泄漏256位AVX寄存器时有显著提速。
• 泄漏变体可能暴露与AES-NI相关的寄存器，可能危及保存在SSE寄存器中的密钥。
• 通过将延迟切换改为主动切换来缓解泄漏风险；在某些内核中，Linux参数 eagerfpu=on 提供了一个解决方法。
• 该漏洞CVE-2018-3665 (INTEL-SA-00145) 已由作者公开披露。