Meltdown and Spectre: Complexity and the death of security

Transcription

1 Meltdown and Spectre: Complexity and the death of security May 8, 2018

2 Meltdown and Spectre: Wait, my computer does what? May 8, 2018

3 Meltdown and Spectre: Whoever thought that was a good idea? May 8, 2018

4 Meltdown and Spectre: I give up. Can I just retire now? May 8, 2018

5 No one alive understands how computers behave.

6

7 Kernel co-location Race conditions Page tables Cache mapping Process forks Branch prediction Cache hierarchy Out-of-order execution Pipelined CPU design High-resolution timers Speculative execution Physical memory map

8 Computers are complex systems.

9

10 kernel kernel stack itunes Page Table Chrome Page Table stack heap data Read data location Read data location heap data code code

11 kernel kernel stack itunes Page Table Chrome Page Table stack heap heap data data code code Read kernel location deadbeef

12 Memory hierarchy and cache Core 0 Core 3 Regs Regs 1: Here s your data 2: Access allowed? L1 data cache L1 inst. cache... L1 data cache L1 inst. cache 1: Access allowed? 2: OK, here s your data L2 unified cache L2 unified cache 1: Access allowed? 2: OK, here s your data 1: Access allowed? 2: OK, here s your data L3 unified cache (shared by all cores) Main Memory

13 Fetch Decode Execute Memory Write back PC update Check for exception PC Inst. Memory PC incr. icode ifun ra rb valc valp A Register file B M E vala valb A L U A ALU B CC ALU cntrl Cnd vale A d d r D a t a Mem cntrl Data Memory valm New PC

14 x86 Pipelining Fetch Decode Exec Mem Write PC Check Fetch Decode Exec Mem Write PC Check Fetch Decode Exec Mem Write PC Check If orange 5 doesn t depend on 3 & 4, why wait? Fetch Decode Exec Mem Write PC Check Fetch Decode Exec Mem Write PC Check

15 x86 Pipelining CDB Reorder buffer µop µop µop µop µop µop µop µop Frontend Branch Predictor µop Cache µops L1 Instruction Cache Instruction Fetch & PreDecode Instruction Queue 4-Way Decode µop µop µop µop MUX Allocation Queue ITLB Execution Engine Memory Subsystem Scheduler µop µop µop µop µop µop µop µop ALU, AES,... ALU, FMA,... ALU, Vect,... ALU, Branch Load data Load data Store data AGU Execution Units Load Buffer Store Buffer L1 Data Cache DTLB STLB L2 Cache µop µop µop µop Green and orange can t retire yet

16 What we know so far You re not supposed to access kernel L1 cache timing is wrong x86 pipelining is complex Macroarchitecture!= microarchitecture First!= First Invisible side effects are visible

17 Cache-based side channels Guess what q is! x = array[q]; Access time [cycles] Page for (i = 0; i < 8; i++) { start_timer(); y = array[i]; stop_timer(); }

18 Meltdown 1 ; rcx = kernel address 2 ; rbx = probe array 3 retry: 4 mov al, byte [rcx] 5 shl rax, 0xc 6 jz retry 7 mov rbx, qword [rbx + rax] Read a byte of the kernel Multiply byte by : Maybe I should check if step 4 was valid Use value to hit cache line

19 Meltdown O-ho! Ah! Second First byte is is x = array[y]; ATTACK! fork() for (i = 0; i < 8; i++) { start_timer(); y = array[i]; stop_timer(); }

20 Meltdown 0 max Physical memory User Kernel Process memory contains... the kernel, which contains physical memory, which contains the memory contents of every process.

21 Meltdown kernel kernel stack stack Short-term fix KAISER/PTI/ KVAS heap heap data data Long-term fix Split address space Replace hardware code code

22 x86 Pipelining CDB Reorder buffer µop µop µop µop µop µop µop µop Frontend Branch Predictor µop Cache µops L1 Instruction Cache Instruction Fetch & PreDecode Instruction Queue 4-Way Decode µop µop µop µop MUX Allocation Queue ITLB Execution Engine Memory Subsystem Scheduler µop µop µop µop µop µop µop µop ALU, AES,... ALU, FMA,... ALU, Vect,... ALU, Branch Load data Load data Store data AGU Execution Units Load Buffer Store Buffer L1 Data Cache DTLB STLB L2 Cache µop µop µop µop

23 Speculative execution if (x < array_length) y = array[x]; a b c d e f g h x is 2 x is 5 x is 1 x is 327 y becomes c y becomes f y becomes b y becomes

24 Spectre variant 1 Cache hit Cache miss if (x < array1_size) Cache hit y = array2[array1[x] * 256]; Cache miss x = &target - &array1 array1[x] is the target

25 Spectre variant 2 widgets

26 Meltdown Spectre Short-term fix KAISER/PTI/ KVAS Microcode patch OS update Recompile binaries Change compiler Browser hardening What about applications? Long-term fix Split address space Replace hardware????

27

28 And so it begins BUSTED

29 And so it begins

30 A return to the past

31

32 Thank you and good luck!