Downfall
Downfall assaults targets a vital weak point present in billions of recent processors utilized in private and cloud computer systems. This vulnerability, recognized as CVE-2022-40982, allows a consumer to entry and steal knowledge from different customers who share the identical pc. For example, a malicious app obtained from an app retailer may use the Downfall assault to steal delicate data like passwords, encryption keys, and personal knowledge resembling banking particulars, private emails, and messages. Equally, in cloud computing environments, a malicious buyer may exploit the Downfall vulnerability to steal knowledge and credentials from different prospects who share the identical cloud pc.
The vulnerability is brought on by reminiscence optimization options in Intel processors that unintentionally reveal inside {hardware} registers to software program. This permits untrusted software program to entry knowledge saved by different applications, which shouldn’t be usually be accessible. I found that the Collect instruction, meant to hurry up accessing scattered knowledge in reminiscence, leaks the content material of the interior vector register file throughout speculative execution. To use this vulnerability, I launched Collect Knowledge Sampling (GDS) and Collect Worth Injection (GVI) strategies. You’ll be able to learn the paper I wrote about this for extra element. Please cite as comply with:
@inproceedings{moghimi2023downfall,
title={{Downfall}: Exploiting Speculative Knowledge Gathering},
writer={Moghimi, Daniel},
booktitle={32th USENIX Safety Symposium (USENIX Safety 2023)},
yr={2023}
}
Demo
Stealing 128-bit and 256-bit AES keys from one other consumer
Stealing arbitrary knowledge from the Linux Kernel
Spying on printable characters
FAQ
[Q] Am I affected by this vulnerability?
[A] Most definitely, sure. This depends upon whether or not your computing gadgets (laptop computer, pill, desktop, cloud, and so on.) use the affected Intel processors. Even when you don’t personal any bodily Intel-based gadgets, Intel’s server market share is greater than 70%, so probably, everybody on the web is affected.[Q] Which computing gadgets are affected?
[A] Computing gadgets based mostly on Intel Core processors from the sixth Skylake to (together with) the eleventh Tiger Lake era are affected. A extra complete listing of affected processors shall be out there here.[Q] What can a hacker do with this?
[A] A hacker can goal high-value credentials resembling passwords and encryption keys. Recovering such credentials can result in different assaults that violate the provision and integrity of computer systems along with confidentiality.[Q] How sensible are these assaults?
[A] GDS is very sensible. It tooks me 2 weeks to develop an end-to-end assault stealing encryption keys from OpenSSL. It solely requires the attacker and sufferer to share the identical bodily processor core, which ceaselessly occurs on modern-day computer systems, implementing preemptive multitasking and simultaneous multithreading.[Q] Is Intel SGX additionally affected?
[A] Along with regular isolation boundaries e.g., digital machines, processes, user-kernel isolation, Intel SGX can be affected. Intel SGX is a {hardware} safety function out there on Intel CPUs to guard consumer’s knowledge towards all type of malicious software program.[Q] What about internet browsers?
[A] In principle, remotely exploiting this vulnerability from the net browser is feasible. In apply, demonstrating profitable assaults by way of internet browsers requires extra analysis and engineering efforts.[Q] How lengthy have customers been uncovered to this vulnerability?
[A] At the very least 9 years. The affected processors have been round since 2014.[Q] Is there a strategy to detect Downfall assaults?
[A] It isn’t simple. Downfall execution seems to be principally like benign purposes. Theoretically, one may develop a detection system that makes use of {hardware} efficiency counters to detect irregular behaviors like exessive cache misses. Nonetheless, off-the-shelf Antivirus software program can not detect this assault.[Q] Is there any mitigation for Downfall?
[A] Intel is releasing a microcode replace which blocks transient outcomes of collect directions and stop attacker code from observing speculative knowledge from Collect.[Q] What’s the overhead for the mitigation?
[A] This depends upon whether or not Collect is within the vital execution path of a program. In line with Intel, some workloads could expertise as much as 50% overhead.[Q] Can I disable the mitigation if my workload doesn’t use Collect?
[A] It is a unhealthy concept. Even when your workload doesn’t use vector directions, trendy CPUs depend on vector registers to optimize widespread operations, resembling copying reminiscence and switching register content material, which leaks knowledge to untrusted code exploiting Collect.
[Q] How lengthy was this vulberability beneath embargo?
[A] Nearly one yr. I reported this vulnerability to Intel August 24, 2022.[Q] Ought to different processor distributors and designers be involved?
[A] Different processors have shared SRAM reminiscence contained in the core, resembling {hardware} register recordsdata and fill buffers. Producers should design shared reminiscence models with additional care to stop knowledge from leaking throughout completely different safety domains and make investments extra in safety validation and testing.[Q] How can I be taught extra about Downfall?
[A] Along with the technical paper, I’m presenting Downfall on the BlackHat USA on August 9th, 2023 and USENIX Security Symposium on August 11, 2023.[Q] Can I play with Downfall?
[A] Right here is the code: https://github.com/flowyroll/downfall/tree/main/POC[Q] Why is that this known as Downfall?
[A] Downfall defeats basic safety boundaries in most computer systems and is a successor to earlier knowledge leaking vulnerabilities in CPUs together with Meltdown and Fallout (AKA MDS). On this trilogy, Downfall defeats all earlier mitigations as soon as once more.[Q] How did you create the emblem?
[A] I used the DALL·E 2 AI system to create the emblem.