Plundervolt: Software-based Fault Injection Attacks against Intel SGX

Abstract

Dynamic frequency and voltage scaling features have been introduced to manage ever-growing heat and power consumption in modern processors. Design restrictions ensure frequency and voltage are adjusted as a pair, based on the current load, because for each frequency there is only a certain voltage range where the processor can operate correctly. For this purpose, many processors (including the widespread Intel Core series) expose privileged software interfaces to dynamically regulate processor frequency and operating voltage. In this paper, we demonstrate that these privileged interfaces can be reliably exploited to undermine the system's security. We present the Plundervolt attack, in which a privileged software adversary abuses an undocumented Intel Core voltage scaling interface to corrupt the integrity of Intel SGX enclave computations. Plundervolt carefully controls the processor's supply voltage during an enclave computation, inducing predictable faults within the processor package. Consequently, even Intel SGX's memory encryption/authentication technology cannot protect against Plundervolt. In multiple case studies, we show how the induced faults in enclave computations can be leveraged in real-world attacks to recover keys from cryptographic algorithms (including the AES-NI instruction set extension) or to induce memory safety vulnerabilities into bug-free enclave code. We finally discuss why mitigating Plundervolt is not trivial, requiring trusted computing base recovery through microcode updates or hardware changes.

OblivSketch: Oblivious Network Measurement as a Cloud Service

“…There are other side-channels such as speculative execution [12], [17], [50], communication patterns [55], power analysis [54] and others [34], [41]. We note that these attacks can be mitigated by some complementary works [8], [16], [20], [56].…”

“…There exist some other side-channel attacks against TEEs. Particularly, those attacks are based on speculative execution [12], [17], [50], communication patterns [55], denialof-service [34], power analysis [54] and vulnerabilities in implementations [41]. Those attacks are out of the scope of OblivSketch.…”

Provably Secure Isolation for Interruptible Enclaved Execution on Small Microprocessors

“…However, security researchers have shown that many of these isolation mechanisms can be attacked by means of software-exploitable side-channels. Such side-channels have been shown to violate integrity of victim programs [3], [4], [5], as well as their confidentiality on both high-end processors [6], [7], [8], [9] and on small microprocessors [10]. In fact, over the past two years, many major isolation mechanisms have been successfully attacked: Meltdown [7] has broken user/kernel isolation, Spectre [8] has broken process isolation and software defined isolation, and Foreshadow [9] has broken enclaved execution on Intel processors.…”

Countermeasures Optimization in Multiple Fault-Injection Context

“…This technique essentially targets security critical embedded systems, using physical disturbances (e.g., laser rays, or electro-magnetic fields) to inject faults. However, it may now also concern much larger software classes when considering recent hardware weaknesses like the so-called Rowhammer attack [1], [2], or by exploiting some weaknesses in the power management modules [3], [4], [5], [6].…”