[论文解读] Leaking Control Flow Information via the Hardware Prefetcher

Yun Chen, Lingfeng Pei+1 more|arXiv (Cornell University)|Sep 1, 2021

Security and Verification in Computing参考文献 51被引用 8

一句话总结

AfterImage 是一种新颖的硬件预取侧信道攻击，利用英特尔基于指令指针的步长预取器，跨代码区域、进程以及用户-内核边界泄露控制流信息。通过在一个执行域中训练预取器，并在另一个域中触发它，该攻击在不依赖推测执行或分支预测操控的情况下，实现了高达 99% 的成功率来泄露机密信息。

ABSTRACT

Modern processor designs use a variety of microarchitectural methods to achieve high performance. Unfortunately, new side-channels have often been uncovered that exploit these enhanced designs. One area that has received little attention from a security perspective is the processor's hard-ware prefetcher, a critical component used to mitigate DRAM latency in today's systems. Prefetchers, like branch predictors, hold critical state related to the execution of the application, and have the potential to leak secret information. But up to now, there has not been a demonstration of a generic prefetcher side-channel that could be actively exploited in today's hardware. In this paper, we present AfterImage, a new side-channel that exploits the Intel Instruction Pointer-based stride prefetcher. We observe that, when the execution of the processor switches between different private domains, the prefetcher trained by one domain can be triggered in another. To the best of our knowledge, this work is the first to publicly demonstrate a methodology that is both algorithm-agnostic and also able to leak kernel data into userspace. AfterImage is different from previous works, as it leaks data on the non-speculative path of execution. Because of this, a large class of work that has focused on protecting transient, branch-outcome-based data will be unable to block this side-channel. By reverse-engineering the IP-stride prefetcher in modern Intel processors, we have successfully developed three variants of AfterImage to leak control flow information across code regions, processes and the user-kernel boundary. We find a high level of accuracy in leaking information with our methodology (from 91%, up to 99%), and propose two mitigation techniques to block this side-channel, one of which can be used on hardware systems today.

研究动机与目标

• 展示一种通用的、与算法无关的侧信道攻击，利用英特尔 IP-步长预取器。
• 逆向分析现代英特尔处理器中 IP-步长预取器的行为及其未公开的特性。
• 证明仅通过硬件预取即可在代码区域、进程边界以及用户-内核转换之间泄露控制流信息。
• 开发适用于现有硬件系统的有效缓解技术。
• 挑战一种假设，即非推测性、非基于分支的侧信道对微架构信息泄露是安全的。

提出的方法

• 通过自定义微基准测试，逆向分析了 IP-步长预取器的结构，包括条目格式、索引、替换策略及置信度更新策略。
• 使用重叠的加载指令来操控指令指针的最低有效位，以在特定步长上训练预取器。
• 通过为 if 和 else 分支使用不同步长，执行训练阶段，将控制流决策编码进预取器状态。
• 通过在新执行上下文中重用相同的 IP 和步长模式，跨域边界（如用户到内核）触发已训练的预取器。
• 利用聚类和时间分析，关联预取事件的缓存访问模式，以推断秘密的控制流决策。
• 提出两种缓解技术：一种基于禁用硬件预取器，另一种使用基于页边界感知的预取，以阻止跨页预取。

实验结果

研究问题

• RQ1 IP-步长预取器能否被利用为侧信道，以在隔离的执行域之间泄露控制流信息？
• RQ2 预取器状态在用户-内核和进程边界之间持续和传播的程度如何？
• RQ3 与分支预测器相比，预取器在训练时间、精度和对 ASLR 的抗性方面有何不同？
• RQ4 能否构建一种在非推测执行路径上运行的侧信道，从而绕过针对推测执行攻击的防御机制？
• RQ5 IP-步长预取器的哪些未公开行为使得跨边界信息泄露成为可能？

主要发现

• AfterImage 在跨代码区域泄露控制流信息方面成功率高达 91% 至 99%。
• IP-步长预取器可跨虚拟页边界预取，从而实现跨页和跨域的信息泄露。
• 与分支预测器相比，该预取器的训练过程更快且更精确，因为它仅使用 IP 的 8 个最低有效位，因此受 ASLR 的影响更小。
• 该攻击在非推测路径上运行，使得许多针对推测执行攻击的现有防御措施失效。
• 逆向分析的预取器模型揭示了未公开的特性，包括置信度计数器机制和页检查策略。
• 一种缓解技术可部署于现有硬件系统，通过禁用跨页预取来阻止该侧信道攻击。