ZombieLoad: Cross-Privilege-Boundary Data Sampling

By Michael Schwarz, Moritz Lipp, Daniel Moghimi, Jo Van Bulck, Julian Stecklina, Thomas Prescher, Daniel Gruss. Conference on Computer and Communications Security, 2019

483 citations recorded by the source corpus.

In early 2018, Meltdown first showed how to read arbitrary kernel memory from user space by exploiting side-effects from transient instructions. While this attack has been mitigated through stronger isolation boundaries between user and kernel space, Meltdown inspired an entirely new class of fault-driven transient-execution attacks. Particularly, over the past year, Meltdown-type attacks have been extended to not only leak data from the L1 cache but also from various other microarchitectural structures, including the FPU register file and store buffer. In this paper, we present the ZombieLoad attack which uncovers a novel Meltdown-type effect in the processor's fill-buffer logic. Our analysis shows that faulting load instructions (i.e., loads that have to be re-issued) may transiently dereference unauthorized destinations previously brought into the fill buffer by the current or a sibling logical CPU. In contrast to concurrent attacks on the fill buffer, we are the first to report data leakage of recently loaded and stored stale values across logical cores even on Meltdown- and MDS-resistant processors. Hence, despite Intel's claims, we show that the hardware fixes in new CPUs are not sufficient. We demonstrate ZombieLoad's effectiveness in a multitude of practical attack scenarios across CPU privilege rings, OS processes, virtual machines, and SGX enclaves. We discuss both short and long-term mitigation approaches and arrive at the conclusion that disabling hyperthreading is the only possible workaround to prevent at least the most-powerful cross-hyperthread attack scenarios on current processors, as Intel's software fixes are incomplete.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/20979d795f0cbbc8776746cd6d3167fa4b97405b

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Fallout: Leaking Data on Meltdown-resistant CPUs (2019, background): “[68] also identify that assists result in transient execution.”
Shredder: Learning Noise Distributions to Protect Inference Privacy (2019, methodology): “Incontrastto Shredder , this model still allows the remote server to have access to the raw data and as the new breaches in hardware [8, 9, 69–71] show, the access can lead to comprised privacy.”
Shredder: Learning Noise to Protect Privacy with Partial DNN Inference on the Edge (2019, methodology): “In contrast to Shredder, this model still allows the remote server to have access to the raw data and as the new breaches in hardware [1, 2, 61, 62, 63, 64] show, the access can lead to comprised privacy.”
Plundervolt: Software-based Fault Injection Attacks against Intel SGX (2020, background): “After a long list of SGX attacks [69, 75, 59, 50] demonstrated how enclave secrets can be reconstructed from a sibling CPU core, Intel ofﬁcially recommended disabling hyperthreading when using SGX enclaves [32].”
SGX-LKL: Securing the Host OS Interface for Trusted Execution (2019, methodology): “We assume that the TEE itself is trustworthy because existing attacks against TEEs, e.g. Spectre [61], Foreshadow [98] and Zombieload [85], are implementation-speciﬁc and orthogonal to our work.”