This week has seen the disclosure of a devastating vulnerability: meltdown and its sister vulnerability, spectre. Both are a symptom of a larger problem that has evidently gone unnoticed for the better part of 50 years of computer architecture: the potential for side-channels in processor pipeline designs.
Aside: I will confess that I am rather ashamed that I didn’t notice this, despite having a background in all the knowledge areas that should have revealed it. It took me all of three sentences of the paper before I realized what was going on. Then again, this somehow got by every other computer scientist for almost half a century. The conclusion seems to be that we are, all of us, terrible at our jobs…
A New Class of Attack, and Implications
I won’t go in to the details of the attacks themselves; there are already plenty of good descriptions of that, not the least of which is the paper. My purpose here is to analyze the broader implications with particular focus on the operating systems security perspective.
To be absolutely clear, this is a very serious class of vulnerabilities. It demands immediate and serious attention from both hardware architects and OS developers, not to mention people further up the stack
The most haunting thing about this disclosure is that it suggests the existence of an entire new class of attack, of which the meltdown/spectre attacks are merely the most obvious. The problem, which has evidently been lurking in processor architecture design for half a century has to do with two central techniques in processor design:
- The fact that processors tend to enhance performance by making commonly-executed things faster. This is done by a whole host of features: memory caches, trace caches, and branch predictors, to name the more common techniques.
- The fact that processor design has followed a general paradigm of altering the order in which operations are executed, either by overlapping multiple instructions (pipelining), executing multiple instructions in parallel (superscalar), executing them out of order and then reconciling the results (out-of-order), and executing multiple possible outcomes and keeping only one result (speculative).
The security community is quite familiar with the impacts of (1): it is the basis for a host of side-channel vulnerabilities. Much of the work in computer architecture deals with implementing the techniques in (2) while maintaining the illusion that everything is executed one instruction at a time. CPUs are carefully designed for this with regard to processor state according to the ISA, carefully tracking which operations depend on which and keeping track of the multiple possible worlds that arise from speculation. What evidently got by us is that the side-channels provided by (1) provide an attacker with the ability to violate the illusion of executing one instruction at a time.
What this almost certainly means is that this is not the last attack of this kind we will see. Out-of-order speculative execution happens to be the most straightforward to attack. However, I can sketch out ways in which even in-order pipelines could potentially be vulnerable. When we consider more obscure architectural features such as trace-caches, branch predictors, instruction fusion/fission, and translation units[0], it becomes almost a certainty that we will see new attacks in this family published well into the future.
A complicating factor in this is that CPU pipelines are extraordinarily complicated, particularly these days. (I recall a tech talk I saw about the SPARC processor, and its scope was easily as large as the FreeBSD core kernel, or the HotSpot virtual machine.) Moreover, these designs are typically closed. There are a lot of different ways a core can be designed, even for a simple ISA, and we can expect entire classes of these design decisions to be vulnerable.
[0]: The x86 architecture tends to have translation units that are significantly more complex than the cores themselves, and are likely to be a nest of side-channels.
OS Security
The implications of this for OS (and even application) security are rather dismal. The one saving virtue in this is that these attacks are read-only: they can be used to exfiltrate data from any memory immediately accessible to the pipeline, but it’s a pretty safe assumption that they cannot be used to write to memory.
That boon aside, this is devastating to OS security. As a kernel developer, there aren’t any absolute defenses that we can implement without a complete overhaul of the entire paradigm of modern operating systems and major revisions to the POSIX specification. (Even then, it’s not certain that this would work, as we can’t know how the processors implement things under the hood.)
Therefore, OS developers are left with a choice among partial solutions. We can make the attacks harder, but we cannot stop them in all cases. The only perfect defense is to replace the hardware, and hope nobody discovers a new side-channel attack.
Attack Surface and Vulnerable Assets
The primary function of these kinds of attacks is to exfiltrate data across various isolation boundaries. The following is the most general description of the capabilities of the attack, as far as I can tell:
- Any data that can be loaded into a CPU register can potentially be converted into the execution of some number of events before a fault is detected
- These execution patterns can affect the performance of future operations, giving rise to a side-channel
- These side-channels can be read through various means (note that this need not be done by the same process)
This gives rise to the ability to violate various isolation boundaries (though only for the purposes of observing state):
- Reads of kernel/hypervisor memory from a guest (aka “meltdown”)
- Reads of another process’ address space (aka “spectre”)
- Reads across intra-process isolation mechanisms, such as different VM instances (this attack is not named, but constitutes, among other things, a perfect XSS attack)
A salient feature of these attacks is that they are somewhat slow: as currently described, the attack will incur 2n + 1 cache faults to read out n bits (not counting setup costs). I do not expect this to last, however.
The most significant danger of this attack is the exfiltration of secret data, ideally small and long-lived data objects. Examples of key assets include:
- Master keys for disk encryption (example: the FreeBSD GELI disk encryption scheme)
- TLS session keys
- Kerberos tickets
- Cached passwords
- Keyboard input buffers, or textual input buffers
More transient information is also vulnerable, though there is an attack window. The most vulnerable assets are those keys which necessarily must remain in memory and unencrypted for long periods of time. The best example of this I can think of is a disk encryption key.
Imperfect OS Defense Mechanisms
Unfortunately, operating systems are limited in their ability to adequately defend against these attacks, and moreover, many of these mechanisms incur a performance penalty.
Separate Kernel and User Page Tables
The solution adopted by the Linux KAISER patches is to unmap most of the kernel from user space, keeping only essential CPU metadata and the code to switch page tables mapped. Unfortunately, this requires a TLB flush for every system call, incurring a rather severe performance penalty. Additionally, this only protects from access to a kernel address; it cannot stop accesses to other process address spaces or crossing isolation boundaries within a process.
Make Access Attempts to Kernel Memory Non-Recoverable
An idea I proposed on the FreeBSD mailing lists is to cause attempted memory accesses to a kernel address range result in an immediate cache flush followed by non-recoverable process termination. This avoids the cost of separate kernel and user page tables, but is not a perfect defense in that there is a small window of time in which the attack can be carried out.
Special Handling of Sensitive Assets
Another potential middle-ground is to handle sensitive kernel assets specially, storing them in a designated location in memory (or better yet, outside of main memory). If a main-memory store is used, this range alone can be mapped and unmapped when crossing into kernel space, thus avoiding most of the overhead of a TLB flush. This would only protect assets that are stored in this manner; however. Anything else (most notably the stacks for kernel threads) would remain vulnerable.
Userland Solutions
Userland programs are even less able to defend against such attacks than the kernel; however, there are architectural considerations that can be made.
Avoid Holding Sensitive Information for Long Periods
As with kernel-space sensitive assets, one mitigation mechanism is to avoid retaining sensitive assets for long periods of time. An example of this is GPG, which keeps the users’ keys decrypted only for a short period of time (usually 5 minutes) after they request to use a key. While this is not perfect, it limits attacks to a brief window, and presents users with the ability create practices which ensure that they shut off other means of attack during this window.
Minimize Potential for Remote Execution
While this only works on systems that are effectively single-user, minimizing the degree to which remote code can execute on ones system closes many vulnerabilities. This is obviously difficult in the modern world, where most websites pull in Javascript from dozens if not hundreds of sources, but it can be done with browser plugins like noscript.
JIT/Interpreter Mitigations
As JIT compilers and interpreters are a common mechanism for limited execution of remote code, they are in a position to attempt to mitigate many of these attacks (there is an LLVM patch out to do this). This is once again an imperfect defense, as they are on the wrong side of Rice’s theorem. There is no general mechanism for detecting these kinds of attacks, particularly where multiple threads of execution are involved.
Interim Hardware Mitigations
The only real solution is to wait for hardware updates which fix the vulnerabilities. This take time, however, and we would like some interim solution.
One possible mitigation strategy is to store and process sensitive assets outside of the main memory. HSMs and TPMs are an example of this (though not one I’m apt to trust), and the growth of the open hardware movement offers additional options. One in particular- which I may put into effect myself -uses a small FPGA device (such as the PicoEVB) programmed with an open design as such a device.
More generally, I believe this incident highlights the value of these sorts of hardware solutions, and I hope to see increased interest in developing open implementations in the future.
Summary
The meltdown and spectre attacks- severe as they are by themselves -represent the beginning of something much larger. A new class of attack has come to the forefront, which enables data exfiltration in spite of hardware security mechanisms, and we can and should expect to see more vulnerabilities of this kind in the future. What makes these vulnerabilities so dangerous is that they directly compromise hardware protection mechanisms on which OS security depends, and thus there is no perfect defense at the OS level against them.
What can and should be done is to adapt and rethink security approaches at all levels. At the hardware level, a paradigm shift is necessary to avoid vulnerabilities of this kind, as is the consideration that hardware security mechanisms are not as absolute as has been assumed. At the OS level, architectural changes and new approaches can harden an OS against these vulnerabilities, but they generally cannot repel all attacks. At the user level, similar architectural changes as well as minimization of attack surfaces can likewise reduce the likelihood and ease of attack, but cannot repel all such attacks.
As a final note, the trend in information security has been increasing focus on application, and particularly web application security. This event, as well as the fact that a relatively simple vulnerability managed to evade detection by the entire field of computer science for half a century strongly suggests that systems security is not at all the solved problem it is commonly assumed to be, and that new thinking and new approaches are needed in this area.
Eric McCorkle's Blog 