Researchers have identified two new methods for attacking AMD processors, but they are not as dangerous as some of the previously disclosed CPU attacks.
Researchers have identified two new methods for attacking AMD processors, but they are not as dangerous as some of the previously disclosed CPU attacks.
The new side-channel attack methods were discovered by a group whose members include some of the researchers who identified Meltdown, Spectre and other vulnerabilities affecting modern processors.
The new attacks, dubbed Collide+Probe and Load+Reload, are related to an optimization feature and they affect AMD processors made between 2011 and 2019.
The problematic feature is a way predictor for the L1-data (L1D) cache and it’s designed to reduce the processor’s power consumption by predicting in which cache way a certain address is located. This cache way predictor was reverse-engineered by the researchers, which led to the discovery of two new side channels that, when combined with previously disclosed attacks such as Spectre, can allow hackers to obtain potentially sensitive data from the targeted device.
“With Collide+Probe, an attacker can monitor a victim’s memory accesses without knowledge of physical addresses or shared memory when time-sharing a logical core. With Load+Reload, we exploit the way predictor to obtain highly-accurate memory-access traces of victims on the same physical core. While Load+Reload relies on shared memory, it does not invalidate the cache line, allowing stealthier attacks that do not induce any last-level-cache evictions,” the researchers explained in their paper.
According to the researchers, the new methods involve software-only attacks that require an attacker to be able to execute code with low privileges. The Collide+Probe attack can also be launched remotely via a web browser without user interaction, which the experts have shown through an attack on ASLR.
“We evaluated our new attack techniques in different scenarios. We established a high-speed covert channel and utilized it in a Spectre attack to leak secret data from the kernel,” the researchers said. “Furthermore, we reduced the entropy of different ASLR implementations from native code and sandboxed JavaScript. Finally, we recovered a key from a vulnerable AES implementation.”
However, they have admitted that the new attacks are not as serious as some of the previously disclosed methods, such as Meltdown and Zombieload, which leaked “tons of actual data” rather than “a few bits of metadata” as the new attacks do.
AMD has published a short statement in response to the disclosure of the new attacks.
“We are aware of a new white paper that claims potential security exploits in AMD CPUs, whereby a malicious actor could manipulate a cache-related feature to potentially transmit user data in an unintended way. The researchers then pair this data path with known and mitigated software or speculative execution side channel vulnerabilities. AMD believes these are not new speculation-based attacks,” AMD said.
The company has advised users and developers to always install operating system and firmware updates, use safe computing practices and security software, follow secure coding methodologies, and implement the latest versions of critical libraries.
The researchers have proposed both software and hardware-based countermeasures, and pointed out that they never claimed to have found new speculation attack methods. While some of the vulnerabilities leveraged by the experts during their tests were previously addressed — as AMD pointed out in its advisory — the researchers say the side channels they exploited still exist and remain unpatched.
“We show how [the new side channels] can be used to leak information from software if it is not written in a side-channel resilient way. While this has become the standard for cryptographic implementations, it is not a solved problem for more complex software, such as OS software or the software stack used when handling keystrokes, network packets, etc. We also show that it can be combined with speculative execution vulnerabilities. This requires the existence of a Spectre gadget. Without a Spectre gadget there is no Spectre attack,” Daniel Gruss of the Graz University of Technology, one of the researchers involved in this projet, told SecurityWeek.
“Yet, these attacks are just showcasing how the side channel works and what properties it has. The side channel itself exists and remains unpatched.” Gruss added.
Related: Researchers Find Critical Security Flaws in AMD Chips
Related: Newer Intel CPUs Vulnerable to Variant 2 of ZombieLoad Attack
Related: CacheOut/L1DES: New Speculative Execution Attack Affecting Intel CPUs
Tags: