Home About Browse Data Privacy Policy Impressum Login Repurposing Segmentation as a Practical LVI-NULL Mitigation in SGX Giner, Lukas and Kogler, Andreas and Canella, Claudio and Schwarz, Michael and Gruss, Daniel (2022) Repurposing Segmentation as a Practical LVI-NULL Mitigation in SGX. In: 31st USENIX Security Symposium. Conference: USENIX-Security Usenix Security Symposium Text lvi_null_sec22.pdf Download (229kB) Abstract Load Value Injection (LVI) uses Meltdown-type data flows in Spectre-like confused-deputy attacks. LVI has been demonstrated in practical attacks on Intel SGX enclaves, and consequently, mitigations were deployed that incur tremendous overheads of factor 2 to 19. However, as we discover, on fixed hardware LVI-NULL leakage is still present. Hence, to mitigate LVI-NULL in SGX enclaves on LVI-fixed CPUs, the expensive mitigations would still be necessary. In this paper, we propose a lightweight mitigation focused on LVI-NULL in SGX, LVI-NULLify. We systematically analyze and categorize LVI-NULL variants. Our analysis reveals that previously proposed mitigations targeting LVI-NULL are not effective. Our novel mitigation addresses this problem by repurposing segmentation, a fast legacy hardware mechanism that x86 already uses for every memory operation. LVI-NULLify consists of a modified SGX-SDK and a compiler extension which put the enclave in control of LVI-NULL-exploitable memory locations. We evaluate LVI-NULLify on the LVI-fixed Comet Lake CPU and observe a performance overhead below 10% for the worst case, which is substantially lower than previous defenses with a prohibitive overhead of 1220% in the worst case. We conclude that LVI-NULLify is a practical solution to protect SGX enclaves against LVI-NULL today. Item Type: Conference or Workshop Item (A Paper) (Paper) Divisions: Michael Schwarz (MS) Conference: USENIX-Security Usenix Security Symposium Depositing User: Michael Schwarz Date Deposited: 06 Oct 2021 06:42 Last Modified: 06 Oct 2021 06:42 Primary Research Area: NRA3: Threat Detection and Defenses URI: https://publications.cispa.saarland/id/eprint/3493 Actions EP3 XML RDF+N-Triples Dublin Core EndNote Simple Metadata BibTeX HTML Citation MODS RDF+N3 MPEG-21 DIDL Reference Manager OpenURL ContextObject in Span RDF+XML OpenURL ContextObject ASCII Citation Atom Multiline CSV METS JSON Refer Actions (login required) View Item CISPA is powered by EPrints 3 which is developed by the School of Electronics and Computer Science at the University of Southampton. More information and software credits.