Intel Software Guard Extension (SGX) is a hardware-based trusted execution environment (TEE) that enables secure computation without trusting any underlying software, such as operating system or even hardware firmware. It provides strong security guarantees, namely, confidentiality and integrity, to an enclave (i.e., a program running on Intel SGX) through solid hardware-based isolation. However, a new controlled-channel attack (Xu et al., Oakland 2015), although it is an out-of-scope attack according to Intel SGX's threat model, demonstrated that a malicious OS can infer coarse-grained control flows of an enclave via a series of page faults, and such a side-channel can be severe for security-sensitive applications. In this paper, we explore a new, yet critical, side-channel attack against Intel SGX, called a branch shadowing attack, which can reveal fine-grained control flows (i.e., each branch) of an enclave program running on real SGX hardware. The root cause of this attack is that Intel SGX does not clear the branch history when switching from enclave mode to non-enclave mode, leaving the fine-grained traces to the outside world through a branch-prediction side channel. However, exploiting the channel is not so straightforward in practice because 1) measuring branch prediction/misprediction penalties based on timing is too inaccurate to distinguish fine-grained control-flow changes and 2) it requires sophisticated control over the enclave execution to force its execution to the interesting code blocks. To overcome these challenges, we developed two novel exploitation techniques: 1) Intel PT-and LBR-based history-inferring techniques and 2) APIC-based technique to control the execution of enclave programs in a fine-grained manner. As a result, we could demonstrate our attack by breaking recent security constructs, including ORAM schemes, Sanctum, SGX-Shield, and T-SGX. Not limiting our work to the attack itself, we thoroughly studied the feasibility of hardware-based solutions (e.g., branch history clearing) and also proposed a software-based countermeasure, called Zigzagger, to mitigate the branch shadowing attack in practice. arXiv:1611.06952v2 [cs.CR] 25 Nov 2016 1 /* bignum.c */ 2 static int mpi_montmul(mbedtls_mpi *A, const mbedtls_mpi *B, 3 const mbedtls_mpi *N, mbedtls_mpi_uint mm, 4 const mbedtls_mpi *T) { 5 size_t i, n, m; 6 mbedtls_mpi_uint u0, u1, *d; 7 8 d = T->p; n = N->n; m = (B->n < n) ? B->n : n; 9 10 for (i = 0; i < n; i++) { 11 u0 = A->p[i]; 12 u1 = (d[0] + u0 * B->p[0]) * mm; 13 14 mpi_mul_hlp(m, B->p, d, u0); 15 mpi_mul_hlp(n, N->p, d, u1); 16 17 *d++ = u0; d[n+1] = 0; 18 } 19 20 ⋆ if (mbedtls_mpi_cmp_abs(A, N) >= 0) { 21 ⋆ mpi_sub_hlp(n, N->p, A->p); 22 ⋆ i = 1; 23 ⋆ } 24 ⋆ else { // dummy subtraction to prevent timing attacks 25 ⋆ mpi_sub_hlp(n, N->p, T->p); 26 ⋆ i = 0; 27 ⋆ } 28 return 0; 29 } Figure 8: Montgomery multiplication (mpi_montmul()) of mbed TLS. The branch shadowing attack can infer whether a dummy subtraction has performed or not.
Lee et al. REF , for instance, demonstrated the feasibility of fine grained control flow attacks in an enclave.
Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing
ArXiv
ArXiv
Computer Science