TLBleed is latest Intel CPU flaw to the surface: But don't expect it to be fixed

Researchers find a new side-channel attack against a performance-enhancing feature in Intel CPUs.

Intel won't be patching a newly revealed side-channel vulnerability in its CPUs, even though it could be used to leak encryption keys for signing a message.

The flaw, which will be presented at the Black Hat USA 2018 conference, is why OpenBSD recently decided to disable hyperthreading on Intel CPUs.

The OpenBSD project's chief, Theo de Raadt, said he dropped support for the feature after viewing the paper from researchers at the Systems and Network Security Group at Vrije Universiteit Amsterdam.

The Register reported on Friday that the paper details an attack on Intel's Hyper-Threading technology to reliably extract a 256-bit EdDSA encryption key used for cryptographically signing data.

The researchers argue that their attack, dubbed TLBleed, is able to leak the keys from another program in no less than 98 percent of tests, depending on the Intel CPU architecture. The leak happens when the key is being used to sign data.

As the attack relies on Intel's Hyper-Threading, this side-channel flaw differs from Spectre and Meltdown, which exploit speculative execution. Intel's Hyper-Threading technology is available on Intel Core, Core vPro, Core M, and Xeon processors.

In a publicly available summary, the researchers note that the side-channel attack leaks information from the Translation Lookaside Buffer (TLB), a special type of memory cache that stores recent translations that map virtual to physical memory addresses.

If Hyper-Threading is enabled, a single core can execute multiple threads simultaneously for performance gains, but that core also shares the same memory caches and TLB.

The attack makes it possible for one thread to see how another accesses the CPU through TLB and use this information to work out secrets from another program stored in shared RAM.

"Our TLBleed exploit successfully leaks a 256-bit EdDSA key from cryptographic signing code, which would be safe from cache attacks with cache isolation turned on, but would no longer be safe with TLBleed. We achieve a 98 percent success rate after just a single observation of signing operation on a co-resident hyperthread and just 17 seconds of analysis time."

The researchers say their attack is able to extract this key while a program is signing a message with the libgcrypt cryptographic library.

However, to exploit the flaw, an attacker would already need to have malware running on a target system or be logged in. But the vulnerability could pose a threat to virtual machines on a public cloud, which could be exploited from another instance on the same machine.

Intel appears unlikely to patch the bug and did not award the researchers payment under its side-channel bug bounty. The company has said its cache attack protections are sufficient to block TLBleed attacks.

However, Ban Gras, one of the researchers behind TLBleed, said in a tweet that the attack shows that cache side-channel protections, such as cash isolation, are not enough.

Intel told ZDNet that it had been made aware of the Vrije Universiteit research and TLBleed, which it stressed is unrelated to Spectre or Meltdown.

"Research on side-channel analysis methods often focuses on manipulating and measuring the characteristics (eg, timing) of shared hardware resources. These measurements can potentially allow researchers to extract information about the software and related data," Intel said in a statement.

"Software or software libraries such as Intel Integrated Performance Primitives Cryptography version U3.1, written to ensure constant execution time and data independent cache traces, should be immune to TLBleed."TLBleed is latest Intel CPU flaw to surface: But don't expect it to be fixed

Researchers find a new side-channel attack against a performance-enhancing feature in Intel CPUs.

Intel won't be patching a newly revealed side-channel vulnerability in its CPUs, even though it could be used to leak encryption keys for signing a message.

The flaw, which will be presented at the Black Hat USA 2018 conference, is why OpenBSD recently decided to disable hyperthreading on Intel CPUs.

The OpenBSD project's chief, Theo de Raadt, said he dropped support for the feature after viewing the paper from researchers at the Systems and Network Security Group at Vrije Universiteit Amsterdam.

The Register reported on Friday that the paper details an attack on Intel's Hyper-Threading technology to reliably extract a 256-bit EdDSA encryption key used for cryptographically signing data.

The researchers argue that their attack, dubbed TLBleed, is able to leak the keys from another program in no less than 98 percent of tests, depending on the Intel CPU architecture. The leak happens when the key is being used to sign data.

As the attack relies on Intel's Hyper-Threading, this side-channel flaw differs from Spectre and Meltdown, which exploit speculative execution. Intel's Hyper-Threading technology is available on Intel Core, Core vPro, Core M, and Xeon processors.

In a publicly available summary, the researchers note that the side-channel attack leaks information from the Translation Lookaside Buffer (TLB), a special type of memory cache that stores recent translations that map virtual to physical memory addresses.

If Hyper-Threading is enabled, a single core can execute multiple threads simultaneously for performance gains, but that core also shares the same memory caches and TLB.

The attack makes it possible for one thread to see how another accesses the CPU through TLB and use this information to work out secrets from another program stored in shared RAM.

"Our TLBleed exploit successfully leaks a 256-bit EdDSA key from cryptographic signing code, which would be safe from cache attacks with cache isolation turned on, but would no longer be safe with TLBleed. We achieve a 98 percent success rate after just a single observation of signing operation on a co-resident hyperthread and just 17 seconds of analysis time."

The researchers say their attack is able to extract this key while a program is signing a message with the libgcrypt cryptographic library.

However, to exploit the flaw, an attacker would already need to have malware running on a target system or be logged in. But the vulnerability could pose a threat to virtual machines on a public cloud, which could be exploited from another instance on the same machine.

Intel appears unlikely to patch the bug and did not award the researchers payment under its side-channel bug bounty. The company has said its cache attack protections are sufficient to block TLBleed attacks.

However, Ban Gras, one of the researchers behind TLBleed, said in a tweet that the attack shows that cache side-channel protections, such as cash isolation, are not enough.

Intel told ZDNet that it had been made aware of the Vrije Universiteit research and TLBleed, which it stressed is unrelated to Spectre or Meltdown.

"Research on side-channel analysis methods often focuses on manipulating and measuring the characteristics (eg, timing) of shared hardware resources. These measurements can potentially allow researchers to extract information about the software and related data," Intel said in a statement.

"Software or software libraries such as Intel Integrated Performance Primitives Cryptography version U3.1, written to ensure constant execution time and data independent cache traces, should be immune to TLBleed."


READ MORE:-