RIDL: Rogue In-Flight Data Load

By S. V. Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, G. Maisuradze, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida. IEEE Symposium on Security and Privacy, 2019

420 citations recorded by the source corpus.

We present Rogue In-flight Data Load (RIDL), a new class of speculative unprivileged and constrained attacks to leak arbitrary data across address spaces and privilege boundaries (e.g., process, kernel, SGX, and even CPU-internal operations). Our reverse engineering efforts show such vulnerabilities originate from a variety of micro-optimizations pervasive in commodity (Intel) processors, which cause the CPU to speculatively serve loads using extraneous CPU-internal in-flight data (e.g., in the line fill buffers). Contrary to other state-of-the-art speculative execution attacks, such as Spectre, Meltdown and Foreshadow, RIDL can leak this arbitrary in-flight data with no assumptions on the state of the caches or translation data structures controlled by privileged software. The implications are worrisome. First, RIDL attacks can be implemented even from linear execution with no invalid page faults, eliminating the need for exception suppression mechanisms and enabling system-wide attacks from arbitrary unprivileged code (including JavaScript in the browser). To exemplify such attacks, we build a number of practical exploits that leak sensitive information from victim processes, virtual machines, kernel, SGX and CPU-internal components. Second, and perhaps more importantly, RIDL bypasses all existing “spot” mitigations in software (e.g., KPTI, PTE inversion) and hardware (e.g., speculative store bypass disable) and cannot easily be mitigated even by more heavyweight defenses (e.g., L1D flushing or disabling SMT). RIDL questions the sustainability of a per-variant, spot mitigation strategy and suggests more fundamental mitigations are needed to contain ever-emerging speculative execution attacks.

Subfields: Artificial Intelligence, Computer Networks and Communications, Surgery

View Paper: https://www.semanticscholar.org/paper/d5e0f5cfb95f9da8b8a9f7a004695dc3eeef0a7e

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Plundervolt: Software-based Fault Injection Attacks against Intel SGX (2020, background): “After a long list of SGX attacks [69, 75, 59, 50] demonstrated how enclave secrets can be reconstructed from a sibling CPU core, Intel officially recommended disabling hyperthreading when using SGX enclaves [32].”
TRRespass: Exploiting the Many Sides of Target Row Refresh (2020, background): “, 19-sided) are effective or in the absence of huge pages in the system, we can still use a variety of page allocator side channels [25], [54], [91] or speculative side channels [37], [93] to locate a sufficiently large contiguous memory chunk to fit our many-sided RowHammer patterns and template me”
ZombieLoad: Cross-Privilege-Boundary Data Sampling (2019, background): “† The RIDL paper [74] only describes one variant leaking from the fill buffers, but also mentions a variant leaking from the load ports without further description or evaluation.”
Fallout: Leaking Data on Meltdown-resistant CPUs (2019, background): “In concurrent works, RIDL [76] and ZombieLoad [68] demonstrate leakage from the Line Fill Buffer (LFB) and load ports on Intel processors.”