CISPA
Browse
cispa_all_3507.pdf (346.28 kB)

AMD Prefetch Attacks through Power and Time

Download (346.28 kB)
conference contribution
posted on 2023-11-29, 18:19 authored by Moritz Lipp, Daniel Gruss, Michael SchwarzMichael Schwarz
Modern operating systems fundamentally rely on the strict isolation of user applications from the kernel. This isolation is enforced by the hardware. On Intel CPUs, this isolation has been shown to be imperfect, for instance, with the prefetch side-channel. With Meltdown, it was even completely circumvented. Both the prefetch side channel and Meltdown have been mitigated with the same software patch on Intel. As AMD is believed to be not vulnerable to these attacks, this software patch is not active by default on AMD CPUs. In this paper, we show that the isolation on AMD CPUs suffers from the same type of side-channel leakage. We discover timing and power variations of the prefetch instruction that can be observed from unprivileged user space. In contrast to previous work on prefetch attacks on Intel, we show that the prefetch instruction on AMD leaks even more information. We demonstrate the significance of this side channel with multiple case studies in real-world scenarios. We demonstrate the first microarchitectural break of (fine-grained) KASLR on AMD CPUs. We monitor kernel activity, e.g., if audio is played over Bluetooth, and establish a covert channel. Finally, we even leak kernel memory with 52.85 B/s with simple Spectre gadgets in the Linux kernel. We show that stronger page table isolation should be activated on AMD CPUs by default to mitigate our presented attacks successfully.

History

Preferred Citation

Moritz Lipp, Daniel Gruss and Michael Schwarz. AMD Prefetch Attacks through Power and Time. In: Usenix Security Symposium (USENIX-Security). 2022.

Primary Research Area

  • Threat Detection and Defenses

Name of Conference

Usenix Security Symposium (USENIX-Security)

Legacy Posted Date

2021-10-12

Open Access Type

  • Green

BibTeX

@inproceedings{cispa_all_3507, title = "AMD Prefetch Attacks through Power and Time", author = "Lipp, Moritz and Gruss, Daniel and Schwarz, Michael", booktitle="{Usenix Security Symposium (USENIX-Security)}", year="2022", }

Usage metrics

    Categories

    No categories selected

    Exports

    RefWorks
    BibTeX
    Ref. manager
    Endnote
    DataCite
    NLM
    DC