S$A: A Shared Cache Attack That Works across Cores and Defies VM Sandboxing -- and Its Application to AES

By Gorka Irazoqui Apecechea, Thomas Eisenbarth, Berk Sunar. IEEE Symposium on Security and Privacy, 2015

367 citations recorded by the source corpus.

The cloud computing infrastructure relies on virtualized servers that provide isolation across guest OS's through sand boxing. This isolation was demonstrated to be imperfect in past work which exploited hardware level information leakages to gain access to sensitive information across co-located virtual machines (VMs). In response virtualization companies and cloud services providers have disabled features such as deduplication to prevent such attacks. In this work, we introduce a fine-grain cross-core cache attack that exploits access time variations on the last level cache. The attack exploits huge pages to work across VM boundaries without requiring deduplication. No configuration changes on the victim OS are needed, making the attack quite viable. Furthermore, only machine co-location is required, while the target and victim OS can still reside on different cores of the machine. Our new attack is a variation of the prime and probe cache attack whose applicability at the time is limited to L1 cache. In contrast, our attack works in the spirit of the flush and reload attack targeting the shared L3 cache instead. Indeed, by adjusting the huge page size our attack can be customized to work virtually at any cache level/size. We demonstrate the viability of the attack by targeting an Open SSL1.0.1f implementation of AES. The attack recovers AES keys in the cross-VM setting on Xen 4.1 with deduplication disabled, being only slightly less efficient than the flush and reload attack. Given that huge pages are a standard feature enabled in the memory management unit of OS's and that besides co-location no additional assumptions are needed, the attack we present poses a significant risk to existing cloud servers.

Subfields: Artificial Intelligence, Signal Processing

View Paper: https://www.semanticscholar.org/paper/b5d75a1fb7de65097f387896595f57fbac93a380

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing (2016, background): “Several researchers further improved this attack to exploit the last level cache [27, 35] and create a low-noise cache storage channel [19].”
High-Resolution Side Channels for Untrusted Operating Systems (2017, methodology): “The prime-and-probe technique has been used in synchronous [36] and asynchronous attacks [30,33], targeting the L1 cache [37] and well as the LLC [30, 33].”
Flush+Flush: A Fast and Stealthy Cache Attack (2015, background): “Cross-VM side-channel attacks [16, 24] and covert channels [28] that tackle these challenges have been presented in the last year.”
SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution (2018, background): “In Prime-Probe attacks [1, 37, 48, 53, 55, 56, 70, 86], by pre-loading cache lines in a cache set, the adversary expects that her future memory accesses (to the same memory) will be served by the cache, unless evicted by the victim program.”
CacheBleed: a timing attack on OpenSSL constant-time RSA (2016, background): “Persistent-state channels have targeted the L1 data cache [9,17,45,46], the L1 instruction cache [1,5,56], the branch prediction buffer [3,4], the last-level cache [31,33,40,51,54], and DRAM open rows [47].”
Malware Guard Extension: Using SGX to Conceal Cache Attacks (2017, background): “Although Flush+Reload attacks have been studied extensively [2], [3], [20], [24]–[29] they are now considered impractical in the cloud as most cloud providers disabled page deduplication and thus disabled the only way to obtain shared memory in the cloud.”
Last-Level Cache Side-Channel Attacks are Practical (2015, background): “[23] describes the use of large pages for mounting a synchronous LLC PRIME+PROBE attack against the last round of AES.”
T-SGX: Eradicating Controlled-Channel Attacks Against Enclave Programs (2017, background): “However, this mitigation is not enough to cope with asynchronous cache timing attacks that use the last-level cache (LLC) [28, 39].”
ARMageddon: Cache Attacks on Mobile Devices (2015, background): “Indeed, existing cross-core attacks exploit the inclusiveness of shared last-level caches [19, 20, 23, 25, 36, 38, 39, 43, 61] and, thus, no cross-core attacks have been demonstrated on ARM so far.”
A Formal Foundation for Secure Remote Execution of Enclaves (2017, background): “These attacks are viable at any privilege, separated by arbitrary protection boundaries [31, 42, 52].”
Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX (2017, neutral): “, access driven attacks [17]) have been demonstrated on x86 architectures, including data caches (and also per-core L2 unified caches) [31], [30], [28], [36], [17], [18], instruction caches [8], [9], [43], and inclusive LLCs [41], [40], [12], [44], [22], [27], [20], [16], [29], [19], [23], [26], [42”
CacheZoom: How SGX Amplifies The Power of Cache Attacks (2017, methodology): “We finally test the resolution of our proposed side channel.”
RIDL: Rogue In-Flight Data Load (2019, background): “Another variant is Prime + Probe [13], [14], [15], [16], in which the attacker builds an eviction set of memory addresses to fill a specific cache set.”
A survey of microarchitectural timing attacks and countermeasures on contemporary hardware (2016, background): “High-resolution LLC attacks that do not rely on shared memory are a recent development [83,105,107,123].”
Peeking Behind the Curtains of Serverless Platforms (2018, background): “Cross-tenant VM sharing in Azure plus the ability to run arbitrary binaries in the function instance could make applications vulnerable to many kinds of side-channel attacks [16, 17, 20, 45].”