: Practical Cache Attacks from the Network
: Practical Cache Attacks from the Network
复制标题
DOI：
10.1109/sp40000.2020.00082
复制
发表时间：
2020-05
期刊：
影响因子：
--
通讯作者：
Michael Kurth;Ben Gras;Dennis Andriesse;Cristiano Giuffrida;H. Bos;Kaveh Razavi
中科院分区：
文献类型：
--
作者：
Michael Kurth;Ben Gras;Dennis Andriesse;Cristiano Giuffrida;H. Bos;Kaveh Razavi
外设性能的提高给现代处理器的内存子系统带来了压力。例如，可用的DRAM吞吐量不再能够维持现代网卡的流量。为了提供承诺的性能，现代英特尔处理器直接在最后一级缓存（LLC）上执行I/O操作，而不是将外设数据传输到DRAM或从DRAM传输。虽然直接缓存访问（DCA）代替直接内存访问（DMA）是一种明智的性能优化，但不幸的是，它的实现没有考虑安全性，因为LLC现在在CPU和所有连接的设备（包括网卡）之间共享。在本文中，我们对DCA的行为进行了逆向工程，广泛地称为数据直接I/O（DDIO），在最近的英特尔处理器上，并提出了它的第一个安全分析。基于我们的分析，我们提出了NetCAT，第一个基于网络的PRIME+PROBE缓存攻击的处理器的LLC的远程机器。我们表明，NetCAT不仅使攻击者可以在网络客户端和沙箱服务器进程（没有网络）之间建立一个隐蔽的通道，但更令人担忧的是，在一般的对抗性设置的合作设置。在此类设置中，NetCAT可以允许披露基于网络计时的敏感信息。作为一个例子，我们展示了对受害者SSH连接的攻击，该受害者SSH连接属于目标服务器上的另一个客户端。我们的研究结果应该提醒处理器供应商对无监督的共享（额外的）微架构组件与外围设备暴露于恶意输入。
Increased peripheral performance is causing strain on the memory subsystem of modern processors. For example, available DRAM throughput can no longer sustain the traffic of a modern network card. Scrambling to deliver the promised performance, instead of transferring peripheral data to and from DRAM, modern Intel processors perform I/O operations directly on the Last Level Cache (LLC). While Direct Cache Access (DCA) instead of Direct Memory Access (DMA) is a sensible performance optimization, it is unfortunately implemented without care for security, as the LLC is now shared between the CPU and all the attached devices, including the network card.In this paper, we reverse engineer the behavior of DCA, widely referred to as Data-Direct I/O (DDIO), on recent Intel processors and present its first security analysis. Based on our analysis, we present NetCAT, the first Network-based PRIME+PROBE Cache Attack on the processor’s LLC of a remote machine. We show that NetCAT not only enables attacks in cooperative settings where an attacker can build a covert channel between a network client and a sandboxed server process (without network), but more worryingly, in general adversarial settings. In such settings, NetCAT can enable disclosure of network timing-based sensitive information. As an example, we show a keystroke timing attack on a victim SSH connection belonging to another client on the target server. Our results should caution processor vendors against unsupervised sharing of (additional) microarchitectural components with peripherals exposed to malicious input.