Plundervolt - Revision history

NKirnbauer: link that doesnt exist

2024-09-25T09:46:31Z

link that doesnt exist

← Older revision		Revision as of 09:46, 25 September 2024
Line 7:		Line 7:
	== Description ==		== Description ==

	Plundervolt, also known as CVE-2019-11157, is a [[Side Channel Attack]], misusing undocumented model-specific registers (MSR) for voltage and frequency regulation. This manipulation aims to undervolt Intel Core x86 processors, introducing faults into error-free code. The primary targets are multiplications, crucial for operations like memory allocation and encryption.<ref name="PLV"/><ref name="PLV1"/>		Plundervolt, also known as CVE-2019-11157, is a Side Channel Attack, misusing undocumented model-specific registers (MSR) for voltage and frequency regulation. This manipulation aims to undervolt Intel Core x86 processors, introducing faults into error-free code. The primary targets are multiplications, crucial for operations like memory allocation and encryption.<ref name="PLV"/><ref name="PLV1"/>

	Plundervolt targets Intel Software Guard eXtensions (SGX), a security feature prevalent in modern Intel CPUs. SGX enclaves operate on specific sections of the CPU's main memory, isolated both at a hardware and software level. This isolation enhances security, allowing sensitive information to remain within secure enclaves on the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>		Plundervolt targets Intel Software Guard eXtensions (SGX), a security feature prevalent in modern Intel CPUs. SGX enclaves operate on specific sections of the CPU's main memory, isolated both at a hardware and software level. This isolation enhances security, allowing sensitive information to remain within secure enclaves on the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>

DRadovanovic: Changed the Summary, added additional information for the description of the attack together with updated information about the mitigation

2024-01-08T08:48:30Z

Changed the Summary, added additional information for the description of the attack together with updated information about the mitigation

← Older revision		Revision as of 08:48, 8 January 2024
Line 2:		Line 2:

	Plundervolt is a [[Fault Injection Attack]] targeting Intel Core x86 processors, by inducing faults through voltage manipulation.		Plundervolt is a [[Fault Injection Attack]] targeting Intel Core x86 processors, by inducing faults through voltage manipulation.

			This exploit is a sophisticated attack leveraging vulnerabilities in Intel Core x86 processors. By manipulating voltage, attackers can induce faults in the CPU, compromising the security of various cryptographic operations and standard computations. The attack exploits specific weaknesses in Intel processors, posing a significant threat to systems relying on these CPUs.<ref name="PLV"/><ref name="PLV1"/>

	== Description ==		== Description ==

	Plundervolt, also known as CVE-2019-11157, is a [[Side Channel Attack]], misusing undocumented model-specific registers (MSR) for voltage and frequency regulation ~~in order~~ to undervolt Intel Core x86 processors ~~and thereby induce~~ faults into error free code. ~~This mechanism can be used to fault~~ multiplications ~~which are the base~~ for operations like memory allocation and encryption.<ref name="PLV"/><ref name="PLV1"/>		Plundervolt, also known as CVE-2019-11157, is a [[Side Channel Attack]], misusing undocumented model-specific registers (MSR) for voltage and frequency regulation. This manipulation aims to undervolt Intel Core x86 processors, introducing faults into error-free code. The primary targets are multiplications, crucial for operations like memory allocation and encryption.<ref name="PLV"/><ref name="PLV1"/>

	Plundervolt ~~attacks~~ Intel Software Guard eXtensions (SGX), a security feature ~~implemented~~ in ~~almost all~~ modern Intel CPUs. ~~The~~ SGX enclaves operate on ~~small~~ sections of the main memory ~~of the CPU. It is usually~~ isolated at a hardware ~~level (separation of SGX memory~~ and ~~CPU memory) and at a~~ software level ~~(encrypted SGX data)~~.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>		Plundervolt targets Intel Software Guard eXtensions (SGX), a security feature prevalent in modern Intel CPUs. SGX enclaves operate on specific sections of the CPU's main memory, isolated both at a hardware and software level. This isolation enhances security, allowing sensitive information to remain within secure enclaves on the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>

	~~This security feature allows developers to isolate various applications inside of secure "enclaves"~~ from the ~~other apps running on~~ the OS. This ~~way~~, ~~sensitive information is kept save inside a safe~~ enclave in the ~~CPU~~.<ref name="PLV"/><ref name="PLV1~~"/><ref name="PLV2~~"/>		The attack methodology combines concepts from the Rowhammer and CLKSCREW attacks. It manipulates the CPU's energy management interface, dynamically altering the voltage and frequency of SGX memory cells. This induces unintended changes in SGX data, compromising the security of the enclave. Plundervolt specifically exploits vulnerabilities in Intel processors, targeting the SGX feature.<ref name="PLV"/><ref name="PLV1"/>

	Plundervolt was first discovered in 2019 by a team of six academics from the following universities:		Plundervolt was first discovered in 2019 by a team of six academics from the following universities:
Line 28:		Line 30:
	* SGX-provided instructions for key derivation and attestation		* SGX-provided instructions for key derivation and attestation

	~~But~~ Plundervolt ~~doesn’t only affect~~ cryptographic ~~code~~, ~~it also affects standard code:~~<ref name="PLV"/><ref name="PLV1"/>		The researchers observed that undervolting specific x86 instructions, particularly multiplications and AES New Instructions (AESNI) extensions, could induce faults. Plundervolt demonstrated practical in-enclave attacks on widely used cryptographic algorithms, including factoring RSA keys, breaking AES-NI, and compromising SGX-provided crypto functions for AES-GCM, ECC signatures, and key exchange.<ref name="PLV"/><ref name="PLV1"/>

	* Faulting Pointer Arithmetic		Plundervolt extends its impact beyond cryptographic code, affecting standard code as well. It introduces faults in pointer arithmetic and memory allocations, emphasizing its broad-reaching consequences for various applications.<ref name="PLV"/><ref name="PLV1"/>
	* Faulting Memory Allocations

	== Attack Vectors ==		== Attack Vectors ==
Line 69:		Line 70:
	== Mitigation and Countermeasures ==		== Mitigation and Countermeasures ==

	Plundervolt is a serious ~~issue. Countermeasures~~ and counterattacks, as published by the researchers~~, for Plundervolt would be~~:<ref name="PLV"/><ref name="PLV1"/>		Plundervolt poses a serious threat, necessitating countermeasures and counterattacks as published by the researchers:<ref name="PLV"/><ref name="PLV1"/>

	* Hardening the trusted in-enclave code, by detecting faulty computation results.<ref name="PLV"/><ref name="PLV1"/>		* Hardening the trusted in-enclave code by detecting faulty computation results.<ref name="PLV"/><ref name="PLV1"/>
	* For cryptographic algorithms, the use of (generic) temporal redundancy (compute-twice-and-compare) ~~is proposed as well as the usage of more~~ algorithm-specific approaches. For instance, in the RSA-CRT case, ~~the~~ signature ~~could be verified~~. In the AES-NI case, ~~the~~ encryption can be verified with a subsequent decryption, and so on.<ref name="PLV"/><ref name="PLV1"/>		* For cryptographic algorithms, advocating the use of (generic) temporal redundancy (compute-twice-and-compare) and algorithm-specific approaches. For instance, in the RSA-CRT case, signature verification is proposed. In the AES-NI case, encryption can be verified with subsequent decryption, and so on.<ref name="PLV"/><ref name="PLV1"/>
	* For noncryptographic code ~~the situation is complicated—the exact results of a~~ fault injection ~~will~~ vary. ~~Mitigations~~ like address space layout randomization ~~(which changes the location of the program in memory each time it runs) make exploits harder~~ but ~~still~~ do not ~~remove~~ the root cause.<ref name="PLV"/><ref name="PLV1"/>		* For noncryptographic code, mitigations are challenging, as fault injection results vary. Techniques like address space layout randomization enhance security but do not eliminate the root cause.<ref name="PLV"/><ref name="PLV1"/>

	Intel has ~~patched the vulnerability in~~ a BIOS update ~~that turns off~~ access to the processor instruction ~~used to produce~~ undervoltage~~, thus stopping any~~ software, including code ~~inside the kernel~~, ~~from fiddling with your~~ CPU voltage ~~while~~ the ~~system is running~~.<ref name="PLV"/><ref name="PLV1"/>		Intel has released a BIOS update, addressing the vulnerability by disabling access to the processor instruction responsible for undervoltage. This preventive measure ensures that software, including kernel code, cannot manipulate CPU voltage during system runtime, effectively mitigating the Plundervolt attack.<ref name="PLV"/><ref name="PLV1"/>

	== Courses ==		== Courses ==

	* [[Ausgewählte Kapitel der IT-Security]] (2021)		* [[Ausgewählte Kapitel der IT-Security]] (2021, 2023)

	== References ==		== References ==
Line 88:		Line 89:

	</references>		</references>


	[[Category:Documentation]]		[[Category:Documentation]]

AFajic: /* Description */

2023-01-06T18:05:09Z

Description

← Older revision		Revision as of 18:05, 6 January 2023
Line 5:		Line 5:
	== Description ==		== Description ==

	Plundervolt, also known as CVE-2019-11157, is a Side Channel Attack, misusing undocumented model-specific registers (MSR) for voltage and frequency regulation in order to undervolt Intel Core x86 processors and thereby induce faults into error free code. This mechanism can be used to fault multiplications which are the base for operations like memory allocation and encryption.<ref name="PLV"/><ref name="PLV1"/>		Plundervolt, also known as CVE-2019-11157, is a [[Side Channel Attack]], misusing undocumented model-specific registers (MSR) for voltage and frequency regulation in order to undervolt Intel Core x86 processors and thereby induce faults into error free code. This mechanism can be used to fault multiplications which are the base for operations like memory allocation and encryption.<ref name="PLV"/><ref name="PLV1"/>

	Plundervolt attacks Intel Software Guard eXtensions (SGX), a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>		Plundervolt attacks Intel Software Guard eXtensions (SGX), a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>

AFajic: /* Mitigation and Countermeasures */

2023-01-06T18:04:36Z

Mitigation and Countermeasures

← Older revision		Revision as of 18:04, 6 January 2023
Line 75:		Line 75:
	* For noncryptographic code the situation is complicated—the exact results of a fault injection will vary. Mitigations like address space layout randomization (which changes the location of the program in memory each time it runs) make exploits harder but still do not remove the root cause.<ref name="PLV"/><ref name="PLV1"/>		* For noncryptographic code the situation is complicated—the exact results of a fault injection will vary. Mitigations like address space layout randomization (which changes the location of the program in memory each time it runs) make exploits harder but still do not remove the root cause.<ref name="PLV"/><ref name="PLV1"/>

	Intel has ~~already~~ patched the vulnerability~~. The patch is~~ a BIOS update that turns off access to the processor instruction used to produce ~~undervoltages~~, thus stopping any software, including code inside the kernel, from fiddling with your CPU voltage while the system is running.<ref name="PLV"/><ref name="PLV1"/>		Intel has patched the vulnerability in a BIOS update that turns off access to the processor instruction used to produce undervoltage, thus stopping any software, including code inside the kernel, from fiddling with your CPU voltage while the system is running.<ref name="PLV"/><ref name="PLV1"/>

	== Courses ==		== Courses ==

AFajic: /* Faulting Memory Allocations */

2023-01-06T18:03:32Z

Faulting Memory Allocations

← Older revision		Revision as of 18:03, 6 January 2023
Line 57:		Line 57:
	=== Faulting Memory Allocations ===		=== Faulting Memory Allocations ===

	The second attack vector is size computations for dynamic memory allocations~~. These allocations~~ are very common and rely on multiplications. For example, a large array of struct elements might be allocated using the following (where red indicates the data type of the variable, teal is a code comment, and green represents a keyword). However, we showed that Plundervolt breaks the processor’s architectural guarantees, as imul (signed multiply) can be faulted to produce erroneous results that are smaller than the expected value. When a multiplication fault occurs during calculation of the size variable, a smaller buffer than expected will be allocated. Because Plundervolt corrupts multiplications silently, without failing the malloc() call, the subsequent code has no means of determining the actual size of the allocated buffer. The allocated buffer will assume a larger buffer for write and read operations and hence read or write out of bounds, corrupting the trusted enclave heap.<ref name="PLV"/><ref name="PLV1"/>		The second attack vector is size computations for dynamic memory allocations, which are very common and rely on multiplications. For example, a large array of struct elements might be allocated using the following (where red indicates the data type of the variable, teal is a code comment, and green represents a keyword). However, we showed that Plundervolt breaks the processor’s architectural guarantees, as imul (signed multiply) can be faulted to produce erroneous results that are smaller than the expected value. When a multiplication fault occurs during calculation of the size variable, a smaller buffer than expected will be allocated. Because Plundervolt corrupts multiplications silently, without failing the malloc() call, the subsequent code has no means of determining the actual size of the allocated buffer. The allocated buffer will assume a larger buffer for write and read operations and hence read or write out of bounds, corrupting the trusted enclave heap.<ref name="PLV"/><ref name="PLV1"/>

	''// Compute size''		''// Compute size''

AFajic: /* Breaking AES-NI */

2023-01-06T18:02:06Z

Breaking AES-NI

← Older revision		Revision as of 18:02, 6 January 2023
Line 37:		Line 37:
	=== Breaking AES-NI ===		=== Breaking AES-NI ===

	The attack vector for breaking the AES-NI encryption instruction (v)aesenc shows that this instruction is vulnerable on the i7-8650U-A processor with –195 mV undervolting and on the i3-7100U-A processor with –232-mV undervolting. The faults were always a single ~~bit~~ flip on the leftmost two bytes of the round function’s output. Such single bit-flip faults are ideally suited for differential fault analysis. The researchers repeated this attack a few times~~. They~~ got a fault in round 8. The bold text indicates the fault propagation from round to round. In round 8, there is a single fault. In round 9, the fault has affected more bytes. By round 10, every byte is affected. They then apply the differential fault analysis technique which, given a pair of correct and faulty ciphertexts on the same plaintext, recovers the full 128-bit AES key with a computational complexity of only 232 + 256 encryptions on average.<ref name="PLV"/><ref name="PLV1"/>		The attack vector for breaking the AES-NI encryption instruction (v)aesenc shows that this instruction is vulnerable on the i7-8650U-A processor with –195 mV undervolting and on the i3-7100U-A processor with –232-mV undervolting. The faults were always single bits flip on the leftmost two bytes of the round function’s output. Such single bit-flip faults are ideally suited for differential fault analysis. The researchers repeated this attack a few times and got a fault in round 8. The bold text indicates the fault propagation from round to round. In round 8, there is a single fault. In round 9, the fault has affected more bytes. By round 10, every byte is affected. They then apply the differential fault analysis technique which, given a pair of correct and faulty ciphertexts on the same plaintext, recovers the full 128-bit AES key with a computational complexity of only 232 + 256 encryptions on average.<ref name="PLV"/><ref name="PLV1"/>

	plaintext: 5ABB97CCFE5081A4598A90E1CEF1BC39		plaintext: 5ABB97CCFE5081A4598A90E1CEF1BC39

AFajic: /* Description */

2023-01-06T18:00:48Z

Description

← Older revision		Revision as of 18:00, 6 January 2023
Line 5:		Line 5:
	== Description ==		== Description ==

	Plundervolt, also known as CVE-2019-11157, is a ~~vulnerability that relies on the fact that if you run an~~ Intel Core x86 processors~~, on a voltage that’s a little bit lower than it usually expects, e~~.~~g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong~~.<ref name="PLV"/><ref name="PLV1"/>		Plundervolt, also known as CVE-2019-11157, is a Side Channel Attack, misusing undocumented model-specific registers (MSR) for voltage and frequency regulation in order to undervolt Intel Core x86 processors and thereby induce faults into error free code. This mechanism can be used to fault multiplications which are the base for operations like memory allocation and encryption.<ref name="PLV"/><ref name="PLV1"/>

	Plundervolt attacks ~~the~~ Intel Software Guard eXtensions (SGX)~~. Intel SGX is~~ a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>		Plundervolt attacks Intel Software Guard eXtensions (SGX), a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>

	This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>		This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>
Line 16:		Line 16:
	* the Graz University of Technology (Austria)		* the Graz University of Technology (Austria)

	The researchers found out that if previous fault injection attack concepts are combined together a new attack can be ~~found~~: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.		The researchers found out that if previous fault injection attack concepts are combined together a new attack can be assembled: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.
	The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>		The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/>

	Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/>		Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of the SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/>

	The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/>		The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/>

AFajic: /* Summary */

2023-01-06T17:52:25Z

Summary

← Older revision		Revision as of 17:52, 6 January 2023
Line 1:		Line 1:
	== Summary ==		== Summary ==

	Plundervolt is a [[Fault Injection Attack]] ~~which attacks~~ Intel Core x86 processors, by ~~generating~~ faults through voltage ~~glitching (specifically undervolting)~~.		Plundervolt is a [[Fault Injection Attack]] targeting Intel Core x86 processors, by inducing faults through voltage manipulation.

	== Description ==		== Description ==

SVrdoljak: /* Faulting Memory Allocations */

2021-12-21T22:33:56Z

Faulting Memory Allocations

← Older revision		Revision as of 22:33, 21 December 2021
Line 66:		Line 66:

	''// ... use array ...''		''// ... use array ...''


	== Mitigation and Countermeasures ==		== Mitigation and Countermeasures ==

SVrdoljak at 22:32, 21 December 2021

2021-12-21T22:32:56Z

← Older revision		Revision as of 22:32, 21 December 2021
Line 58:		Line 58:

	The second attack vector is size computations for dynamic memory allocations. These allocations are very common and rely on multiplications. For example, a large array of struct elements might be allocated using the following (where red indicates the data type of the variable, teal is a code comment, and green represents a keyword). However, we showed that Plundervolt breaks the processor’s architectural guarantees, as imul (signed multiply) can be faulted to produce erroneous results that are smaller than the expected value. When a multiplication fault occurs during calculation of the size variable, a smaller buffer than expected will be allocated. Because Plundervolt corrupts multiplications silently, without failing the malloc() call, the subsequent code has no means of determining the actual size of the allocated buffer. The allocated buffer will assume a larger buffer for write and read operations and hence read or write out of bounds, corrupting the trusted enclave heap.<ref name="PLV"/><ref name="PLV1"/>		The second attack vector is size computations for dynamic memory allocations. These allocations are very common and rely on multiplications. For example, a large array of struct elements might be allocated using the following (where red indicates the data type of the variable, teal is a code comment, and green represents a keyword). However, we showed that Plundervolt breaks the processor’s architectural guarantees, as imul (signed multiply) can be faulted to produce erroneous results that are smaller than the expected value. When a multiplication fault occurs during calculation of the size variable, a smaller buffer than expected will be allocated. Because Plundervolt corrupts multiplications silently, without failing the malloc() call, the subsequent code has no means of determining the actual size of the allocated buffer. The allocated buffer will assume a larger buffer for write and read operations and hence read or write out of bounds, corrupting the trusted enclave heap.<ref name="PLV"/><ref name="PLV1"/>


	''// Compute size''		''// Compute size''
Line 71:		Line 70:
	== Mitigation and Countermeasures ==		== Mitigation and Countermeasures ==

	~~[[Device to~~ be ~~used~~ with ~~this documentation]]~~		Plundervolt is a serious issue. Countermeasures and counterattacks, as published by the researchers, for Plundervolt would be:<ref name="PLV"/><ref name="PLV1"/>
	~~[[Maybe another device~~ to be used with ~~this documentation]]~~
			* Hardening the trusted in-enclave code, by detecting faulty computation results.<ref name="PLV"/><ref name="PLV1"/>
			* For cryptographic algorithms, the use of (generic) temporal redundancy (compute-twice-and-compare) is proposed as well as the usage of more algorithm-specific approaches. For instance, in the RSA-CRT case, the signature could be verified. In the AES-NI case, the encryption can be verified with a subsequent decryption, and so on.<ref name="PLV"/><ref name="PLV1"/>
			* For noncryptographic code the situation is complicated—the exact results of a fault injection will vary. Mitigations like address space layout randomization (which changes the location of the program in memory each time it runs) make exploits harder but still do not remove the root cause.<ref name="PLV"/><ref name="PLV1"/>

			Intel has already patched the vulnerability. The patch is a BIOS update that turns off access to the processor instruction used to produce undervoltages, thus stopping any software, including code inside the kernel, from fiddling with your CPU voltage while the system is running.<ref name="PLV"/><ref name="PLV1"/>

	== Courses ==		== Courses ==