SmotherSpectre

Exploiting Speculative Execution through Port Contention

The 2018 Shock

Detour to a quick crash course on Meltdown and Spectre

• There are two key steps in Meltdown & Spectre
  • Source of the attack (OoO andSpeculative Execution)
  • Medium of leak (predominantly Caches)
• Umpteen works on sealing the medium of leakage (Caches, BPU, etc.)
• But how do we know there are only a finite number of mediums? And sealing a medium kills the attack? 
• This work shows that there's yet another medium that's the source of leakage
• (What does it tell us?) - It might be more worthwhile to go behind the source than behind the medium

Another disadvantage with Cache side channels

• Consider Spectre V2 - Branch Target injection
•  Pollute BTB - speculate target to branch to a gadget code and execute it (gadget code with loads from critical memory)
• But finding a gadget code that gets the data to the cache is very hard except in a few cases such eBPF (Berkeley's Packet Filter)
• Hence, costly solutions like Retpoline (indirect branches don't speculate) is not applied widely
• However, the current work claims to make V2 more practical - since we are not limited to load gadgets alone!

Idea

SMoTher

• The attack is based on the following observation
  • Two SMT threads share Execution units
  • Instructions that are scheduled to execute on the same port will contend

SMoTher Differentiability

• Let one SMT thread run a set of instructions \( V = \{V0, V1, V2,...\} \)
• Attacker runs a set of instructions A
• If Attacker can infer some \( V_i \in V\) the sequences in V are said to be SMoTher Differentiable

Pitfalls

• Synchronization of attacker and victim is crucial. If the code sequence is short, this is hard to achieve
• Pipeline bottlenecks other than port contention can overshadow the side channel (e.g. RAW hazards)
• The CPU may eliminate the execution of some instructions (zero idioms). This removes contention
• Some instructions (e.g. SSE and AVX) are subject to aggressive power-saving features on modern CPUs. This makes measuring very difficult

SMoTherSpectre

• Leverages BTI to poison BPU making one SMT thread jump to an address upon an indirect jump to execute a code with SMoTher Differentiable code
• Unlike cache side channels, you don't need a measurable change in the micro-architectural state here 
• Apparently, SMoTher differentiable gadgets are easy to find unlike cache load gadgets
• libcrypto in OpenSSL has 12,000 such gadgets readily available

Key Assumptions

• To maximize the success rate
  • Introduce N taken branches before indirect branch
  • Disable ASLR
  • Evict cache line containing indirect jump pointer
  • Know if BTI worked using performance counter
    • BR_MISP_EXEC.TAKEN_INDIRECT_JUMP_NON_CALL_RET 

Gadgets

• There are two types of gadgets that's required to make SMoTherSpectre successful i.e. BTI gadget and SMoTher gadget

• Pass a secret through a register to an arbitrary code in the same process
• Ideal BTI targets are virtual function calls in C++ that happens through a vtable and dynamically linked ELF calls that will go through GOT
• If we evict vtable and GOT from cache, it gives around ~200 cycles to reliably mount the attack

• The gadget is either a part of the victim or an additional attack vector by the attacker 
• The gadget consists of,
  • Instruction comparing the secret register to a known value 
  • Followed by a conditional-flow transfer depending on the comparison
  • The instructions should have distinct port fingerprint
    • Port fingerprinting is the task of ranking two instruction sequences based on their port utilization 
  • Instructions should not have other memory references to caches - that will inject noise

Real World OpenSSH attack

Mitigations

• Disable SMT entirely (15% overhead on Intel machines)
• OS can employ side-channel aware strategy i.e. colocate only threads from the same user on same SMT threads
• Can explore the utilities of coarse-grained or interleaved Multithreading as viable alternatives for SMT
• Figure out a solution for BTI (such as Retpoline)
  • But it should have very low overheads (<Disabling SMT obviously)
  • However SMoTherspectre can also employ other Spectre Variants (e.g. RSB overflow) to mount the attack