RASSLE: Return Address Stack based Side-channel LEakage

Abstract

Microarchitectural attacks on computing systems often stem from simple artefacts in the underlying architecture. In this paper, we focus on the Return Address Stack (RAS), a small hardware stack present in modern processors to reduce the branch miss penalty by storing the return addresses of each function call. The RAS is useful to handle specifically the branch predictions for the RET instructions which are not accurately predicted by the typical branch prediction units. In particular, we envisage a spy process who crafts an overflow condition in the RAS by filling it with arbitrary return addresses, and wrestles with a concurrent process to establish a timing side channel between them. We call this attack principle, RASSLE 1 (Return Address Stack based Side-channel Leakage), which an adversary can launch on modern processors by first reverse engineering the RAS using a generic methodology exploiting the established timing channel. Subsequently, we show three concrete attack scenarios: i) How a spy can establish a covert channel with another co-residing process? ii) How RASSLE can be utilized to determine the secret key of the P-384 curves in OpenSSL (v1.1.1 library)? iii) How an Elliptic Curve Digital Signature Algorithm (ECDSA) secret key on P-256 curve of OpenSSL can be revealed using Lattice Attack on partially leaked nonces with the aid of RASSLE? In this attack, we show that the OpenSSL implementation of scalar multiplication on this curve has varying number of add-and-sub function calls, which depends on the secret scalar bits. We demonstrate through several experiments that the number of add-and-sub function calls can be used to template the secret bit, which can be picked up by the spy using the principles of RASSLE. Finally, we demonstrate a full end-to-end attack on OpenSSL ECDSA using curve parameters of curve P-256. In this part of our experiments with RASSLE, we abuse the deadline scheduler policy to attain perfect synchronization between the spy and victim, without any aid of induced synchronization from the victim code. This synchronization and timing leakage through RASSLE is sufficient to retrieve the Most Significant Bits (MSB) of the ephemeral nonces used while signature generation, from which we subsequently retrieve the secret signing key of the sender applying the Hidden Number Problem.
 1RASSLE is a non-standard spelling for wrestle.

Comprehensive Evaluation of RSB and Spectre Vulnerability on Modern Processors

“…In our proposed covert channel, the error rate is equal to 8.6E-5%, which is considerably lower than previous work and therefore, no error correction technique is required. Our covert channel increases the bandwidth compared to [38], by 3.76×. Moreover, [38] has a 15% to 25% error rate.…”

“…Our covert channel increases the bandwidth compared to [38], by 3.76×. Moreover, [38] has a 15% to 25% error rate. Our method can send more bits per context switch by increasing the number of gadgets.…”

“…These attacks introduce effective covert channels based on commonly targeted system components. Recently, Chakraborty et al [38] proposes a covert channel based on RSB. In this method, the receiver first fills the RSB, then the sender executes a function or does nothing to push or not to push an irrelevant address to the RSB structure to transfer 1 or 0 to the receiver.…”

“…Our method can send more bits per context switch by increasing the number of gadgets. For instance, with four gadgets, in one context switch, the sender can transmit 00/01/10/11 to the receiver, and this increases the bandwidth, while [38] sends one bit for each context switch. Furthermore, the receiver in [38] should call N nested functions in a for loop to determine the transmitted value, which reduces the bandwidth and increases the error rate.…”

“…For instance, with four gadgets, in one context switch, the sender can transmit 00/01/10/11 to the receiver, and this increases the bandwidth, while [38] sends one bit for each context switch. Furthermore, the receiver in [38] should call N nested functions in a for loop to determine the transmitted value, which reduces the bandwidth and increases the error rate. Furthermore, unlike the cache-based covert channel, our covert channel on RSB does not rely on assumptions such as memory deduplication.…”