JackHammer: Efficient Rowhammer on Heterogeneous FPGA-CPU Platforms
JackHammer: Efficient Rowhammer on Heterogeneous FPGA-CPU Platforms
复制标题
JackHammer：异构 FPGA-CPU 平台上的高效 Rowhammer
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
B. Sunar
中科院分区：
文献类型：
--
作者：
Zane Weissman;T. Tiemann;D. Moghimi;E. Custodio;T. Eisenbarth;B. Sunar
经过多年的发展，FPGA终于出现在多租户云服务器上。异构的FPGA-CPU微架构需要重新评估有关隔离和安全边界的常见假设，因为它们会引入新的攻击向量和漏洞。在这项工作中，我们分析了内存和高速缓存子系统，并研究Rowhammer和高速缓存攻击，由英特尔提出的两个异构的FPGA-CPU平台：Arria 10 GX与集成的FPGA-CPU平台，和Arria 10 GX PAC扩展卡，通过PCIe接口将FPGA连接到CPU。我们展示了JackHammer，一种新颖，高效，隐身的Rowhammer从FPGA到主机的主存储器。我们的研究结果表明，恶意的FPGA可以执行两倍的速度从CPU在同一系统上的典型Rowhammer，并导致约四倍的CPU攻击位翻转。我们通过对WolfSSL RSA签名实现的实际故障攻击证明了FPGA中JackHammer的有效性，该实现在平均58个RSA签名后可靠地导致故障，比CPU Rowhammer快25%。在某些情况下，我们的JackHammer攻击产生错误签名的频率是传统CPU Rowhammer的三倍以上，速度几乎是传统CPU Rowhammer的三倍。最后，我们系统地分析了新的高速缓存攻击在这些环境中的高速缓存隐蔽通道跨FPGA和CPU的演示。
After years of development, FPGAs are finally making an appearance on multi-tenant cloud servers. Heterogeneous FPGA-CPU microarchitectures require reassessment of common assumptions about isolation and security boundaries, as they introduce new attack vectors and vulnerabilities. In this work, we analyze the memory and cache subsystem and study Rowhammer and cache attacks enabled by two proposed heterogeneous FPGA-CPU platforms from Intel: the Arria 10 GX with an integrated FPGA-CPU platform, and the Arria 10 GX PAC expansion card which connects the FPGA to the CPU via the PCIe interface. We demonstrate JackHammer, a novel, efficient, and stealthy Rowhammer from the FPGA to the host’s main memory. Our results indicate that a malicious FPGA can perform twice as fast as a typical Rowhammer from the CPU on the same system and causes around four times as many bit flips as the CPU attack. We demonstrate the efficacy of JackHammer from the FPGA through a realistic fault attack on the WolfSSL RSA signing implementation that reliably causes a fault after an average of fifty-eight RSA signatures, 25% faster than a CPU Rowhammer. In some scenarios our JackHammer attack produces faulty signatures more than three times more often and almost three times faster than a conventional CPU Rowhammer. Finally, we systematically analyze new cache attacks in these environments following demonstration of a cache covert channel across FPGA and CPU.