New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs
A new interrupt injection attack can bypass Spectre v2 defenses on Intel and AMD CPUs, allowing an unprivileged Linux program to time a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it.
Intelligence analysis by Llama
Researchers Daniël Trujillo and Mengjia Yan have discovered a technique called INTERRUPT INJECTION that can bypass Spectre v2 defenses on Intel and AMD CPUs. This attack can be used to leak arbitrary kernel memory, which can be used to read sensitive information such as password hashes.
Imagine you're trying to sneak a peek at a secret message. The message is protected by a special lock that makes it hard to read. But what if you could use a special trick to open the lock and read the message? That's basically what the researchers have discovered - a way to bypass the lock and read the message. This is a big deal because it could let hackers get access to sensitive information on a system.
Analysis
Interrupt Injection Attack: A New Spectre v2 Bypass Technique
The researchers, Daniël Trujillo and Mengjia Yan, have discovered a new technique called INTERRUPT INJECTION that can bypass Spectre v2 defenses on Intel and AMD CPUs. This attack works by timing a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it. This allows an unprivileged Linux program to inject an interrupt at a precise moment, disrupting the Safe-RET sequence and potentially leading to data leakage through speculative execution.
How the Attack Works
The attack works by exploiting the fact that interrupts can fire almost anywhere and Linux lets any user schedule them with nanosecond granularity. The researchers widened their odds by evicting the bytes from L1 and L2 cache using a sibling hyperthread, slowing them down, and by picking the write syscall, which left them controlling two registers. Interrupts landed inside the window 5% to 12% of the time, and around 2% with those registers under attacker control.
Impact on Spectre v2 Defenses
The researchers' attack demonstrates that Spectre v2 defenses are not foolproof and can be bypassed using this technique. This means that an attacker can potentially use this attack to gain access to sensitive information on a system. The researchers have disclosed their findings to AMD and Intel, and a fix is in the Linux kernel. However, the researchers believe that an end-to-end attack is possible on Intel as well by combining their Interrupt Injection primitive with existing work.
Conclusion
The researchers' discovery of the INTERRUPT INJECTION technique highlights the ongoing vulnerability of Spectre v2 defenses. This attack demonstrates that an attacker can potentially use this technique to bypass Spectre v2 defenses and gain access to sensitive information on a system. The researchers' findings have significant implications for the security of systems that rely on Spectre v2 defenses.
Key points
- Researchers Daniël Trujillo and Mengjia Yan have discovered a technique called INTERRUPT INJECTION that can bypass Spectre v2 defenses on Intel and AMD CPUs.
- This attack works by timing a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it.
- The attack can be used to leak arbitrary kernel memory, which can be used to read sensitive information such as password hashes.
- A fix is in the Linux kernel, but the researchers believe that an end-to-end attack is possible on Intel as well by combining their Interrupt Injection primitive with existing work.
The discovery of the INTERRUPT INJECTION technique highlights the ongoing vulnerability of Spectre v2 defenses. However, the researchers' findings also demonstrate the importance of continued research and development in the field of computer security. With the help of researchers like Trujillo and Yan, we can continue to improve the security of systems and protect against emerging threats.
The discovery of the INTERRUPT INJECTION technique also highlights the potential risks of relying on Spectre v2 defenses. If an attacker can use this technique to bypass Spectre v2 defenses, it could potentially lead to data leakage through speculative execution. This could have significant consequences for systems that rely on Spectre v2 defenses.
