PaperlayerView exact revision on arXiv

Source-linked AI summary

Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX

Wenhao Wang, Guoxing Chen, Xiaorui Pan, Yinqian Zhang, XiaoFeng Wang, Vincent Bindschaedler, Haixu Tang, Carl A. Gunter

arXiv:1705.07289v2cs.CR

TL;DR

SGX side-channel defenses have concentrated on page-fault attacks, leaving the broader memory-management attack surface insufficiently understood. The paper systematically analyzes that surface, identifies eight attack vectors, and develops attacks exploiting accessed flags, timing, caches, and DRAM. Its results show that attacks can avoid high AEX rates and achieve 64B-granularity observation, exposing limitations in existing protections.

  • Problem

    Page-fault defenses leave unclear whether other SGX memory channels exist, whether protections raise attacker costs, and whether page faults are the most effective leakage path.

  • Method

    The paper performs an in-depth analysis of SGX memory side channels and develops attacks combining accessed flags, timing, caches, DRAM, and related memory channels.

  • Results

    The study identifies 8 attack vectors, reduces EdDSA recovery to 1,300 interrupts versus 71,000 for page faults, and reaches 64B-granularity observation through cache-DRAM combinations.

  • Takeaways & Limitations

    SGX defenses should account for the entire memory-side-channel surface rather than relying on anomalously high AEX rates or page-granularity assumptions.

  • Takeaways & Limitations

    The analysis is limited to confidentiality threats involving memory management and address translation, excluding enclave software bugs and non-memory side channels.

Abstract

from arXiv · show

Side-channel risks of Intel's SGX have recently attracted great attention. Under the spotlight is the newly discovered page-fault attack, in which an OS-level adversary induces page faults to observe the page-level access patterns of a protected process running in an SGX enclave. With almost all proposed defense focusing on this attack, little is known about whether such efforts indeed raise the bar for the adversary, whether a simple variation of the attack renders all protection ineffective, not to mention an in-depth understanding of other attack surfaces in the SGX system. In the paper, we report the first step toward systematic analyses of side-channel threats that SGX faces, focusing on the risks associated with its memory management. Our research identifies 8 potential attack vectors, ranging from TLB to DRAM modules. More importantly, we highlight the common misunderstandings about SGX memory side channels, demonstrating that high frequent AEXs can be avoided when recovering EdDSA secret key through a new page channel and fine-grained monitoring of enclave programs (at the level of 64B) can be done through combining both cache and cross-enclave DRAM channels. Our findings reveal the gap between the ongoing security research on SGX and its side-channel weaknesses, redefine the side-channel threat model for secure enclaves, and can provoke a discussion on when to use such a system and how to use it securely.

1 INTRODUCTION

The paper argues that SGX memory side-channel defenses have focused too narrowly on page faults despite a broader attack surface. It systematically analyzes memory channels and develops attacks that reduce observable side effects and achieve finer-grained monitoring.

  • Attack-surface analysis: Existing defenses primarily target page-fault attacks, leaving uncertainty about whether page faults are the only or most effective leakage channel.The paper notes that enclave interactions with externally managed virtual and physical memory may expose additional avenues for information leakage.
  • Attack-surface analysis: 8 memory-related attack vectors span address-translation caches, page tables, caches, and DRAM across the SGX memory-management path.The analysis covers TLBs, paging-structure caches, main-memory page tables, and the cache and DRAM hierarchy.
  • Reducing side effects: Sneaky page monitoring uses page-table accessed flags to observe page visits without directly triggering an interrupt on each first access.The technique sets and resets accessed flags rather than inducing a page fault for every page access.
  • Reducing side effects: 1,300 interrupts recovered an EdDSA 512-bit secret key, versus 71,000 for page faults and 33,000 for direct accessed-flag monitoring.The reported timing enhancement makes the attack nearly invisible to known interrupt-based defenses because normal execution also generates thousands of interrupts.
  • Implications: The study concludes that existing protections can remain vulnerable while adding only marginal attacker cost, motivating reassessment of SGX security limitations and deployment practices.Its findings are intended to provoke discussion about when and how SGX-like technologies should be used.
  • Improving spatial granularity: Combining cache and DRAM channels enables 64B-granularity enclave observation, undermining defenses that co-locate sensitive code and data within 4KB pages.The paper also develops cross-enclave Prime+Probe, cross-enclave DRAMA, and cache-DRAM attacks.

2 BACKGROUND

SGX isolates enclave memory through hardware-protected reserved memory, while relying on untrusted system software for page-table management. EPC eviction extends the enclave address range using authenticated encryption, and the paper limits its analysis to confidentiality threats involving memory management and address translation.

  • Memory isolation: Processor Reserved Memory is a physically exclusive range protected from accesses by the operating system, hypervisors, SMM code, and DMA.The Enclave Page Cache is a subset of this reserved range for enclave pages and control structures.
  • Virtual and physical memory: Enclave virtual addresses occupy an ELRANGE mapped to EPC pages, while untrusted system software manages the page tables translating those addresses.The TLB handles EPC translations using conventional mechanisms.
  • Security checks: The EPCM records each EPC page’s owner enclave, page type, and allocation validity to check translations against page-table manipulation.The CPU consults the EPCM during address translation as an additional isolation check.
  • Security checks: An extended Page Miss Handler verifies page-table correctness and performs additional checks when enclave execution or address translation reaches protected memory.These checks prevent invalid or unauthorized mappings into the processor-reserved region.
  • Memory encryption: EPC pages can be evicted to regular memory, with hardware authenticated encryption protecting the confidentiality and integrity of their contents.The Memory Encryption Engine encrypts evicted EPC pages, while a MAC protects integrity.
  • Scope and assumptions: The paper studies confidentiality side channels involving memory management and address translation, excluding enclave software bugs and non-memory side channels.The stated adversary is system software with privileges such as an operating-system or hypervisor role.
  • Scope and assumptions: Demonstrated attacks assume knowledge of the victim binary, enclave base address, and complete virtual-to-physical mapping, but not source code.Experiments were conducted on real SGX platforms.

3 UNDERSTANDING ATTACK SURFACES

SGX memory references expose attack surfaces across address translation, page tables, caches, and DRAM. The paper analyzes how shared resources and page-table state can reveal enclave activity, including accessed and dirty-page behavior, while attack side effects may expose the attack itself.

  • Attack surface overview: Memory references traverse address-translation caches, page tables, caches, and DRAM, creating attack surfaces at each stage.The paper examines vectors involving TLBs, paging-structure caches, page tables, cache levels, and DRAM row buffers.
  • Address translation caches: HyperThreading can share TLBs and paging-structure caches between enclave and non-enclave code, enabling interference-based observation and TLB clearing.The paper uses this vector in the HT-SPM attack.
  • Address translation caches: AEX-related flushing of TLB and paging-structure-cache entries may reveal flushed entries across process contexts, but this vector was not confirmed on the tested Skylake processor.The authors attribute the failed confirmation to differences between processor-manual specifications and expect the vector could appear in future processors.
  • Page tables: Referenced page-table entries can be cached as regular data, enabling cross-core Flush+Reload tracing of enclave page-level access patterns.The paper characterizes this as a timing-channel counterpart to sneaky page monitoring.
  • Page tables: Accessed flags reveal page visits after page-table walks, and the paper exploits this mechanism in sneaky page monitoring attacks.TLB hits can suppress later accessed-flag updates until eviction, motivating address-translation interference in the attack.
  • Page tables: Dirty flags can reveal enclave writes to new pages, potentially enabling finer-grained inference of secret-dependent memory writes.The paper also notes that reserved PTE bits and the NX flag can trigger enclave-mode page faults.
  • Cache and memory hierarchy: SGX leaves cache side channels applicable across enclave and non-enclave code, while shared DRAM row buffers can expose whether a target row was recently accessed.The authors empirically confirmed cache threats and identify DRAM sharing as unavoidable among processes accessing the same bank.
  • Side effects: Observable side effects include AEXs and execution slowdown; original page-fault attacks reportedly slow targets by one or two orders of magnitude.Frequent AEXs and prolonged execution intervals can make attacks detectable.

4 REDUCING SIDE EFFECTS WITH SNEAKY PAGE MONITORING ATTACKS

Sneaky page monitoring (SPM) reduces the interrupt side effects of memory side-channel attacks while retaining useful observations of enclave execution. Its variants exploit accessed flags, timing, and shared TLB resources, and experiments show effective attacks with substantially lower overhead or AEX frequency than page-fault attacks.

  • Motivation: Page-fault attacks generate an interrupt for each page access, causing one- to two-order-of-magnitude slowdowns and making their high frequency potentially detectable.SPM instead seeks comparable effectiveness with less frequent AEXs.
  • B-SPM: Accessed Flags Monitoring: B-SPM repeatedly records and resets page-table accessed flags, recovering groups of pages visited between inspections.Because TLB entries suppress later accessed-flag updates, B-SPM uses TLB shootdowns to force renewed page-table accesses.
  • B-SPM: Accessed Flags Monitoring: B-SPM trades resolution for fewer interrupts: it cannot recover the visiting order of pages observed in the same inspection round, but shootdowns are needed only for repeated observations.This is lighter than generating an interrupt for every new page access.
  • T-SPM: Timing Enhancement: T-SPM uses execution timing to infer secret-dependent paths within a page, avoiding interrupts during intervals while still distinguishing paths with different completion times.The attack can therefore remain informative even when code is placed on the same page as a page-fault defense.
  • HT-SPM: TLB Flushing through HyperThreading: HyperThreading enables HT-SPM to clear shared TLBs without TLB shootdowns, rendering interrupt-based protections ineffective in the described setting.The attack exploits resource sharing between enclave and non-enclave code on sibling virtual cores.
  • Evaluation of Effectiveness: 73.47% of Hunspell words were uniquely identifiable with B-SPM, while its 5.1× slowdown was far below the page-fault attack’s 1214.9× overhead.For FreeType, T-SPM recovered 72.14% of words with 16% overhead, compared with 100% recovery and 252× slowdown for the page-fault attack.
  • Silent Attacks on EdDSA: 1,300 interrupts recovered the full EdDSA session key with T-SPM, versus about 71,000 for page faults and 33,000 for B-SPM.Normal EdDSA execution generated at least 1,500 AEXs, making the demonstrated T-SPM attack potentially unobservable by interrupt-rate defenses.

5 IMPROVING SPATIAL GRANULARITY WITH CACHE-DRAM ATTACKS

The paper shows that cross-enclave memory attacks can observe enclave behavior at substantially finer granularity than page-fault attacks. A cache-DRAM attack reaches 64-byte accuracy while avoiding the approximately 1000× slowdown associated with disabling caching, though DRAMA-based methods face caching and false-positive limitations.

  • Motivation: Page-fault defenses that co-locate sensitive code and data within pages assume page granularity is the adversary’s limit, but the paper shows that assumption is false.The demonstrated alternatives include cross-enclave Prime+Probe, DRAMA, and cache-DRAM attacks.
  • Cross-enclave Prime+Probe: Cross-enclave Prime+Probe achieves 16KB spatial granularity on a processor with an 8196-set last-level cache.The experiment ported GnuPG 1.4.13 to Graphene-SGX and confirmed that Prime+Probe works across enclaves.
  • Cross-enclave DRAMA: DRAMA infers victim accesses from faster timing to a probe sharing the victim’s DRAM bank and row, but 8KB rows make false detections likely.A faster access to p suggests that the victim touched address d; unrelated row hits can arise because multiple code or data regions share a row.
  • Cross-enclave DRAMA: Cross-enclave DRAMA is constrained because cached EPC accesses reveal no DRAM information unless caching is disabled, which slows the enclave approximately 1000×.The attack also commonly produces false detections from unrelated accesses to shared DRAM rows.
  • Cache-DRAM Attack: The cache-DRAM attack combines LLC Prime+Probe with cross-enclave DRAMA, using cache conflicts to drive targeted accesses to DRAM without disabling caching.The attack uses two threads: one primes and probes the relevant cache set, while the other performs cross-enclave DRAMA.
  • Cache-DRAM Attack: 64 byte spatial accuracy matches Flush+Reload, while priming only the targeted cache set reduces false positives caused by shared DRAM rows.In the Gap 4.8.6 experiment, the attack detected an input-dependent branch with probability 14.6% and less than 1% false positives, with 2% enclave slowdown.

6 MITIGATION AND DISCUSSION

The analysis shows that existing SGX defenses address only parts of the memory side-channel surface, while combined channels and finer-grained observations can evade common assumptions. It therefore calls for broader software awareness and, in some cases, hardware support.

  • Analysis of Attack Surfaces: The cache-DRAM attack offers 64-byte spatial accuracy, the finest granularity among the listed memory side channels.Flush+Reload is infeasible on SGX enclaves because EPC pages belong to only one enclave at a time.
  • Effectiveness of Existing Defenses: Deterministic multiplexing hides secret-dependent flows within pages but remains vulnerable to cache and DRAMA attacks.
  • Effectiveness of Existing Defenses: T-SGX does not guarantee that accessed- and dirty-flag updates will not leak memory access information.Transaction aborts are not strictly enforced when referenced page-table flags are updated.
  • Effectiveness of Existing Defenses: Sanctum hides page-access patterns with enclave-specific page tables but remains exposed to cross-enclave DRAMA attacks.The operating system knows the enclave memory layout and can place an attack process in a different DRAM region sharing a row with the target.
  • Effectiveness of Existing Defenses: SGX-Shield’s fine-grained ASLR can be defeated over time because it does not support live re-randomization.
  • SGX Application Development: Attackers can monitor enclave processes through pages, caches, inter-page timing, cross-enclave DRAM, and HyperThreading, so avoiding page-level patterns is insufficient.Intra- or inter-page timing can also disclose sensitive information.
  • Software-level Protection: Defenses cannot rely on anomalously high AEX rates, page co-location, or a single channel because attacks may be finer-grained or combine multiple channels.
  • Hardware Enhancement: Hardware changes such as cache or DRAM partitioning and enclave-resident page tables may be the best mitigation for some memory side channels.

7 RELATED WORK

Related work establishes page-fault, cache, branch-prediction, and other SGX side channels, while showing that most defenses target page-fault leakage specifically. The paper distinguishes its memory-side-channel scope and emphasizes stealthier alternatives to conventional page-fault attacks.

  • Paging-based side channels: Paging attacks force accesses or execution on selected non-present or non-executable pages to trap into the OS, revealing enclave page accesses.
  • Paging-based side channels: Prior work also exploited accessed and dirty PTE flags and Flush+Flush or Flush+Reload attacks on referenced PTEs.
  • Paging-based side channels: The paper’s accessed-flag attacks were designed to reduce interrupts, whereas a concurrent approach could introduce more AEXs and be less effective against T-SGX and DÉJÀ VU.
  • Branch prediction side channels: Branch prediction is a separate SGX side-channel surface and is outside this paper’s memory-side-channel attack surface.
  • Cache Side Channels: Cache attacks remain feasible on SGX across data, instruction, and inclusive last-level caches under an access-driven threat model.
  • SGX Side-Channel Defenses: Most known SGX defenses were designed specifically for page-fault side channels, including compiler transformations, T-SGX, and secure enclave architectures.

8 CONCLUSION

The paper presents an in-depth study of SGX memory side channels, broadening the attack surface beyond page faults and examining implications for effective and secure TEE use.

  • Conclusion: The study summarizes 8 memory-management attack vectors ranging from TLB to DRAM.
  • Conclusion: Its novel attacks exploit accessed flags, timing, HyperThreading, and DRAM modules, and can be stealthier and lighter than page-fault attacks.Their effectiveness is comparable with the known attack in some cases.
  • Conclusion: The findings expose a gap between proposed SGX defenses and system design weaknesses while broadening side-channel analysis of SGX.
Loading 1705.07289v2…