64
Cache Storage Channels Alias-driven Attacks Roberto Guanciale Mads Dam Hamed Nemati Christoph Baumann

Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

  • Upload
    others

  • View
    2

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Cache Storage Channels Alias-drivenAttacks

Roberto GuancialeMads DamHamed NematiChristoph Baumann

Page 2: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Formally Verified Platforms

Page 3: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Formally Verified Platforms

Page 4: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Formally Verified Platforms

Caches Excluded from the analysis

Page 5: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Formally Verified Platforms

Caches Excluded from the analysis

Page 6: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Formally Verified Platforms

Caches Excluded from the analysis

Page 7: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Formally Verified Platforms

Caches Excluded from the analysis

Page 8: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Formally Verified Platforms

Caches Excluded from the analysis

Models should be Sound

Page 9: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Formally Verified Platforms

Caches Excluded from the analysis

Models should be Sound

Storage Channels caninvalidate results

Page 10: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

VirtualAddress

MMU

Cacheable(std-memory)

Non-cacheable(devices)

Incoherent Cache Behaviors

Page Tables

Page 11: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Mismatched cacheability attributes

Page 12: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

do not do this

Mismatched cacheability attributes

Page 13: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

do not do thisPlease,

Mismatched cacheability attributes

Page 14: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

do not do thisPlease,

Mismatched cacheability attributes

Incoherent Cache Behaviors

Page 15: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

ARM-terminology: unexpected cache hit

if the data cache reports a hit on a memory location that is marked as non-cacheable, the cache might access the memory disregarding such hit.

do not do thisPlease,

Mismatched cacheability attributes

Incoherent Cache Behaviors

Page 16: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Hypervisor

OS OS

Scenarios

Page 17: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Hypervisor

OS OS OSARM

TrustZoneService

Scenarios

Page 18: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Hypervisor

OS OS OSARM

TrustZoneService

Kernel

DeviceDriver

UserProcess

Scenarios

Page 19: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c line dirty

Attacker

Victimcache

memory

Page 20: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

Attacker

Victim

VA_nc

PA

VA_c line dirtycache

memory

Page 21: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

Attacker

Victim

VA_nc

PA

VA_c line dirtycache

memory

Page 22: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

Attacker

Victim

VA_nc

PA

VA_c line dirtycache

0memory

Page 23: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c line dirty

Attacker

Victimcache

0memory

Page 24: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c line dirty

Attacker

Victimcache

0memory

Page 25: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c line dirty

Attacker

Victimcache

0memory

Page 26: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

0memory

Page 27: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

0memory

Page 28: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

Page 29: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

Page 30: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

Page 31: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

Page 32: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

Page 33: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

Page 34: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

Page 35: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

Page 36: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

Page 37: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

D == 0

Page 38: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

D == 0

Page 39: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c0 F

line dirty

Attacker

Victimcache

1memory

eviction

Page 40: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c line dirty

Attacker

Victimcache

1memory

eviction

Page 41: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c line dirty

Attacker

Victimcache

1memory

Page 42: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

VA_nc

PA

VA_c line dirty

Attacker

Victimcache

1memory

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

Page 43: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c line dirty

Attacker

Victimcache

1memory

Page 44: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c1 F

line dirty

Attacker

Victimcache

1memory

Page 45: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

write(VA_nc, 0)…write(VA_nc, 1)free(VA_nc)

D = access(VA_c)…D = access(VA_c)if not policy(D) Reject()…use(VA_c)

VA_nc

PA

VA_c1 F

line dirty

Attacker

Victimcache

1memory

Page 46: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Integrity threat

● Transfer of memory ownership

● Time Of Check To Time Of Use attacks

● No need of● simultaneous double mapping● concurrency

Natural preys: reference monitors

Storage channels

Page 47: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

cache

VA_nc

VA_c PA1

VA3

VA2 PA2

PA3

invalidate(VA_c)write(VA_nc, 0)D = read(VA_c)write(VA_nc, 1)call victimD = read(VA_c)

if secret access(VA2)else access(VA3)

Attacker

Victim

Page 48: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

cache

VA_nc

VA_c PA1

VA3

VA2 PA2

PA3Accessedcache line is

secret-dependent

invalidate(VA_c)write(VA_nc, 0)D = read(VA_c)write(VA_nc, 1)call victimD = read(VA_c)

if secret access(VA2)else access(VA3)

Attacker

Victim

Page 49: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

cache

VA_nc

VA_c PA1

VA3

VA2 PA2

PA3

invalidate(VA_c)write(VA_nc, 0)D = read(VA_c)write(VA_nc, 1)call victimD = read(VA_c)

if secret access(VA2)else access(VA3)

Attacker

Victim

Cache is ashared resource

Page 50: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

cache

VA_nc

VA_c PA1

VA3

VA2 PA2

PA3

invalidate(VA_c)write(VA_nc, 0)D = read(VA_c)write(VA_nc, 1)call victimD = read(VA_c)

if secret access(VA2)else access(VA3)

Attacker

Victim

Mismatchedcacheabilityattributes

Page 51: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Confidentiality threat

● Access driven attacks

● No external measure needed

● Difficult to counter-measure at probing time

Natural preys: look-up tablesNatural preys: reference monitors

Storage channels

Integrity threat

● Transfer of memory ownership

● Time Of Check To Time Of Use

● No need of● simultaneous double mapping● concurrency

Page 52: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Hypervisor

▸ Beagleboard

ParavirtualizingHypervisor

PT PT

Linux

Linux prepares a PT

Page 53: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Linux

Hypervisor makesregion read-only

▸ Beagleboard

ParavirtualizingHypervisor

Hypervisor

PT PT

Page 54: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Hypervisor

PT PT

Linux

Hypervisor validatescontent

▸ Beagleboard

ParavirtualizingHypervisor

Page 55: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Hypervisor

PT PT

Linux

Hypervisor activatesPT

▸ Beagleboard

ParavirtualizingHypervisor

Page 56: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Hypervisor

PT PT

Linux

Hypervisor activatesPT

▸ Beagleboard

ParavirtualizingHypervisor

Page 57: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Hypervisor

PT PT

Linux

Hypervisor activatesPT

▸ Beagleboard▸ Linux takes

complete control

ParavirtualizingHypervisor

Page 58: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

OSTrustZone

Service

Vulnerability:

c[j]=Kn[j] xor T4[s[j]]

▸ Raspberry PI 2▸ 128-bit key extracted after

850 encryptions

AESCryptoservice

Page 59: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Integrity threatguarantee memory coherency

● cache flushes(8x overhead)

● selective eviction(0.2x overhead)

Countermeasures

Page 60: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Integrity threatguarantee memory coherency

● cache flushes(8x overhead)

● selective eviction(0.2x overhead)

CountermeasuresConfidentiality threatstandard timing approaches

● secret-independent accesses(5x overhead)

● no cache for secret accesses(6x overhead)

Page 61: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Integrity threatguarantee memory coherency

● cache flushes(8x overhead)

● selective eviction(0.2x overhead)

CountermeasuresConfidentiality threatstandard timing approaches

● secret-independent accesses(5x overhead)

● no cache for secret accesses(6x overhead)

Vector specific

● avoid uncacheable aliases(0.15x overhead)

Page 62: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Integrity threatguarantee memory coherency

● cache flushes(8x overhead)

● selective eviction(0.2x overhead)

CountermeasuresConfidentiality threatstandard timing approaches

● secret-independent accesses(5x overhead)

● no cache for secret accesses(6x overhead)

Vector specific

● avoid uncacheable aliases(0.15x overhead)

HW Countermeasures

● do not disregardunexpected cache hit

Page 63: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

Confidentiality threat using self-modifying code

Concluding remarks

Ongoing work

● Repair formal verification

● TLBs / Branch prediction / …

● Experimentation in multi-core

● Evaluating HW countermeasures

Page 64: Cache Storage Channels · Integrity threat guarantee memory coherency cache flushes (8x overhead) selective eviction (0.2x overhead) Countermeasures Confidentiality threat standard

THANKS!

Any questions?You can find me at [email protected]://prosper.sics.se/http://haspoc.sics.se/