Uncategorized

SGX Spectre

sgx spectre

On January 3, 2018 3 new vulnerabilities have been identified, named “Meltdown” and “Spectre“, with the following CVE:

  • Variant 1: bounds check bypass (CVE-2017-5753) – Spectre
  • Variant 2: branch target injection (CVE-2017-5715) – Spectre
  • Variant 3: rogue data cache load (CVE-2017-5754) – Meltdown

 

In the last days a reserchears group from Ohio State University have pulished a new research about these vulnerabilities, showing one other feature of Spectre variant.

During the first analysis about the problem, it wasn’t clear if Spectre was applicable also on CPU Intel’s SGX Version.

SGX extension (Software Guard eXtension) is a modality made available to the latest Intel CPUs (on the 6th CPU generation based on Skylake architecture). This mode adds a set of instructions that allows the creation of protected areas (named “Enclave”) in which is possible to manage sensitive data (encryption keys, sensitive data, etc).

intel

Source: https://newsroom.intel.com/news/intel-microsoft-enterprise-blockchain-service

The implementation of this feature is completely assigned to the application level, so an application must be developed to use this information management way, through SDK made available by Intel or with the direct use of dedicated opcodes.

Thanks to Ohio University’s research, it’s clear that evenn in this mode the CPU can be attacked according to the same Speculative Execution principles applied to the previous vulnerabilities detected.

 

HOW TO DEFEND YOURSELF

At present, researchers report that Intel has released some microcode patches (hardware patches) in order to mitigate branch target injection attacks.

  • Indirect Branch Restricted Speculation (IBRS)
  • Single Thread Indirect Branch Predictors (STIBP)
  • Single Thread Indirect Branch Predictors (STIBP)

 

It is also reported that the “Retpolin” solution consists of a completely software solution to the problem through  the use of “RET”, insted of indirect JPM and CALL which don’t work in case of this specific vulnerability (page 12 of the whitepaper mentioned in references).

 

Researcher team suggestion is addressed to developers: 

  • Microcode version check for developers of Enclave environments in order to verify that the CPU has the needed hardware pathces
  • A recommendation for developers of libraries using SGX (SDK) capabilities to remove some parties that make exploit vulnerbaility easier

 

REFERENCES