A new attack called 'TONTOU' has emerged that bypasses Spectre v2 countermeasures, demonstrating the leakage of Linux password hashes.
Researchers at the Massachusetts Institute of Technology (MIT) Computer Science and Artificial Intelligence Laboratory (CSAIL) have announced a new attack method called 'TONTOU' that bypasses existing countermeasures against 'Spectre v2,' which exploits speculative execution of CPUs. The research team has demonstrated that they can use TONTOU to read Linux kernel memory and retrieve the contents of '/etc/shadow,' where password hashes are stored.
TONTOU: On the Exploitability of Time-of-Neutralization to Time-of-Use Windows
(PDF file)
Spectre is an attack that exploits 'speculative execution,' a technique CPUs use to speed up processing. The CPU predicts branching paths and execution routes and executes instructions in advance, but even if the prediction is wrong and the processing result is discarded, traces may remain in the cache or elsewhere. By analyzing these remaining traces, attackers can infer information that they would not normally have access to.
Spectre variant 2 (Spectre v2), a type of Spectre, misleads the CPU's branch prediction mechanism, leading it speculatively to processes handling sensitive information. Intel and AMD have implemented countermeasures such as 'neutralization,' which involves erasing or isolating the internal state used for branch prediction from attackers.
The following are examples of sanitization processes presented in the paper. The top row, 'Entry neutralization,' shows a method of sanitizing immediately after entering the kernel, while the bottom row, 'In-place neutralization,' shows a method of sanitizing immediately before the branch to be protected. Both methods aim to prevent erroneous speculative execution by Spectre v2 by sanitizing dangerous predictive information before executing the branch.
However, the research team noticed a slight time lag between the completion of the neutralization process and the actual use of the branch prediction. 'TONTOU,' an acronym for 'Time-of-Neutralization to Time-of-Use,' is a technique that re-injects information favorable to the attacker into the neutralized branch predictor.
The conceptual diagram in the paper is as follows: ① First, the branch predictor is neutralized on the kernel side. ② Next, the attacker directs the victim's processing to the Training gadget, ③ and the Training gadget re-infects the branch predictor. ④ Finally, the contaminated prediction state is used for the protected branch, leading to speculative execution to the Disclosure gadget and leaking confidential information. In other words, the branch predictor, which has been cleaned up once by the countermeasure, is re-infected just before use.
TONTOU also utilizes 'Interrupt Injection,' which generates interrupts at a predetermined timing. By setting a timer from a program with general user privileges and generating an interrupt during kernel processing, it may be possible to influence the branch predictor again.
The research team tested TONTOU on Intel's Cascade Lake Refresh and Arrow Lake, and AMD's Zen 2 and Zen 4. In the Intel environment, they succeeded in retraining some of the branch prediction mechanisms, and on AMD Zen 2, they were able to bypass Linux's Spectre v2 countermeasure 'Safe RET'. On the other hand, they did not observe any false branching on AMD Zen 4 using the same method.
The figure below shows the results of investigating the possibility of interrupts occurring at opportune moments for attacks by varying the size of the 'post-neutralization window' between sanitization and branching. Although the degree differs between Zen 2, Zen 4, Cascade Lake Refresh, and Arrow Lake, it was confirmed that there is room to insert interrupts between the sanitization process and branching.
Furthermore, in experiments using an AMD Ryzen 7 4700G, it was successful in reading Linux kernel memory at an average speed of 5.47 bytes per second with an average accuracy of 91.97%. In an experiment to locate '/etc/shadow', it was successful in 5 out of 10 attempts, with an average time of 18 minutes. It should be noted that the attack requires the ability to execute code with normal user privileges on the target machine.
The research team has suggested countermeasures such as resetting the branch predictor to a safe state when returning from interrupt handling. AMD has also published the scope of the impact, and the paper explains that a fix is planned for the Linux kernel. The research team states that TONTOU has shown that even 'after implementing Spectre v2 countermeasures,' which were previously considered safe, can still be targeted by attacks.
Related Posts:
in Security, Posted by log1d_ts