MIT’s new chip attack steals protected Linux data in 5 attempts

Researchers at the Massachusetts Institute of Technology (MIT) have uncovered a new processor attack that can bypass defenses in Intel and AMD chips by exploiting a security gap lasting only a handful of instructions. The technique, developed by MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL), was presented at Black Hat USA and USENIX Security in August. Dubbed “TONTOU,” it allowed the researchers to access protected Linux memory and retrieve the system’s root password file. Processor defenses leave a tiny opening Modern processors improve performance by predicting which path a program is likely to follow and beginning the work before the correct path is confirmed. If that prediction is wrong, the processor discards the work, although traces can remain behind. Attackers can analyze those traces to extract information from areas of memory they should not be able to access. This type of speculative execution attack gained widespread attention after the Spectre vulnerability was disclosed in 2018. Existing defenses attempt to stop such attacks by wiping or isolating the processor’s prediction machinery before predictions are used. However, MIT PhD student Daniël Trujillo and Assistant Professor Mengjia Yan found that these two actions cannot occur simultaneously. That leaves a short window during which malicious activity can contaminate the prediction machinery again. To exploit it reliably, the researchers developed a technique called “interrupt injection.” Computers routinely interrupt their current work to perform tasks triggered by timers, hardware, or network traffic. Ordinary programs can also configure these timers. By precisely controlling a timer, the researchers caused the processor to handle an interrupt inside the vulnerable window. Code executed during that interruption altered the prediction machinery before the processor could use it. Attack works against Intel and AMD chips The researchers evaluated TONTOU across four processor generations from Intel and AMD and successfully caused mispredictions on chips from both companies. On Intel processors, the attack bypassed two protections: a software-based defense used for older chips and a hardware defense incorporated into newer processors. The newer mechanism stopped the attack on one Intel generation but failed on another, indicating that implementations can differ between chip designs. AMD’s “saferet” defense cleans the prediction machinery immediately before it is used. This leaves a window only two instructions wide, typically lasting tens of nanoseconds. The MIT team still reached it by slowing the processor at the targeted point, making the brief opening easier to hit. Linux password file retrieved The researchers demonstrated the threat on an AMD computer running a current Linux kernel. They first defeated a security measure that randomizes the operating system’s location in memory, succeeding in all 10 attempts. Each attempt took approximately nine minutes. AMD and Intel were notified in early February, while Linux kernel maintainers were contacted in March. AMD subsequently released a mitigation available through operating-system updates. The researchers proposed cleaning prediction machinery again after an interrupt finishes. This approach appears viable for AMD, but could make attacks more reliable on some Intel systems. Get the latest in engineering, tech, space & science - delivered daily to your inbox.Atharva is a full-time content writer with a post-graduate degree in media & amp; entertainment and a graduate degree in electronics & telecommunications. He has written in the sports and technology domains respectively. In his leisure time, Atharva loves learning about digital marketing and watching soccer matches. His main goal behind joining Interesting Engineering is to learn more about how the recent technological advancements are helping human beings on both societal and individual levels in their daily lives.