PaperlayerView exact revision on arXiv

Source-linked AI summary

ZombieLoad: Cross-Privilege-Boundary Data Sampling

Michael Schwarz, Moritz Lipp, Daniel Moghimi, Jo Van Bulck, Julian Stecklina, Thomas Prescher, Daniel Gruss

arXiv:1905.05726v1cs.CR

TL;DR

Existing transient-execution attacks had expanded beyond kernel memory and L1 cache leakage, but unexplored microarchitectural buffers and non-architectural faults remained to be examined. The paper presents ZombieLoad, analyzes fill-buffer-based data sampling, and demonstrates leakage across major protection boundaries. It concludes that disabling hyperthreading is the only possible workaround on current processors.

  • Problem

    The paper addresses unexplored microarchitectural buffers and whether both architectural and microarchitectural faults can trigger Meltdown-type data leakage.

  • Method

    The paper develops ZombieLoad by targeting fill-buffer logic and combining transient-execution primitives with incidental time-domain data sampling.

  • Results

    ZombieLoad leaks recently loaded values across user processes, protection rings, virtual machines, logical cores, and SGX enclaves.

  • Takeaways & Limitations

    The authors conclude that disabling hyperthreading is the only possible workaround to mitigate ZombieLoad on current processors.

  • Takeaways & Limitations

    ZombieLoad is a one-dimensional, time-controlled side channel and therefore cannot generally steer leakage through specific addresses.

Abstract

from arXiv · show

In early 2018, Meltdown first showed how to read arbitrary kernel memory from user space by exploiting side-effects from transient instructions. While this attack has been mitigated through stronger isolation boundaries between user and kernel space, Meltdown inspired an entirely new class of fault-driven transient execution attacks. Particularly, over the past year, Meltdown-type attacks have been extended to not only leak data from the L1 cache but also from various other microarchitectural structures, including the FPU register file and store buffer. In this paper, we present the ZombieLoad attack which uncovers a novel Meltdown-type effect in the processor's previously unexplored fill-buffer logic. Our analysis shows that faulting load instructions (i.e., loads that have to be re-issued for either architectural or microarchitectural reasons) may transiently dereference unauthorized destinations previously brought into the fill buffer by the current or a sibling logical CPU. Hence, we report data leakage of recently loaded stale values across logical cores. We demonstrate ZombieLoad's effectiveness in a multitude of practical attack scenarios across CPU privilege rings, OS processes, virtual machines, and SGX enclaves. We discuss both short and long-term mitigation approaches and arrive at the conclusion that disabling hyperthreading is the only possible workaround to prevent this extremely powerful attack on current processors.

1 INTRODUCTION

ZombieLoad extends Meltdown-type attacks by exploiting fill-buffer behavior to sample recently loaded stale values across privilege, process, virtualization, and logical-core boundaries. The paper combines incidental time-domain sampling with side-channel primitives and demonstrates practical attacks, including SGX compromise.

  • Research gap and attack: ZombieLoad targets previously unexplored fill-buffer logic and exploits both architectural and microarchitectural faults.Microarchitectural faults re-issue memory requests without becoming architecturally visible.
  • Research gap and attack: Faulting or internally re-issued loads may transiently compute on stale values from prior memory operations on the current or sibling hyperthread.The attack recovers these “zombie load” values without explicit address-based selectors.
  • Research gap and attack: ZombieLoad combines incidental time-domain data sampling with traditional side-channel primitives to create targeted leakage in the address domain.This links traditional memory-based side channels with Meltdown-type attacks that recover values from explicit addresses.
  • Practical implications: The paper demonstrates leakage across processes, privilege boundaries, virtual machines, and logical CPU cores, including secrets from SGX enclaves.Reported scenarios include browser monitoring, AES-key extraction, cross-VM covert channels, and SGX sealing-key recovery.
  • Mitigation: The authors conclude that disabling hyperthreading, together with flushing several microarchitectural states during context switches, is the only possible workaround on current processors.The introduction presents this as the practical mitigation conclusion for the demonstrated attack.

2 BACKGROUND

The background explains how out-of-order and speculative execution leave persistent microarchitectural side effects, then introduces the memory, microcode, TSX, and SGX mechanisms relevant to ZombieLoad.

  • Processor execution: Out-of-order execution preserves architectural equivalence by committing results in program order, while speculative execution continues along predicted branch paths.Incorrect speculation flushes the pipeline, but transient execution can still matter through microarchitectural state.
  • Transient execution attacks: Transient execution attacks exploit microarchitectural side effects that remain after transient instructions and their architectural effects are discarded.Meltdown-type attacks exploit execution after CPU exceptions, whereas Spectre-type attacks exploit misprediction.
  • Memory system: The line-fill buffer serves as the interface to higher cache levels and main memory, tracks outstanding loads, and handles uncacheable and non-temporal memory accesses.Loads can merge when they correspond to earlier load-buffer entries.
  • Memory system: On a fault, a load may be re-issued and remain marked valid and completed in the memory-order buffer until the faulting micro-operation retires.Retirement then handles the fault and flushes the pipeline.
  • Microcode: Microcode assists route complex slow-path operations through predefined microcode routines after a faulting micro-operation produces an event code.Committing the micro-operation causes in-flight micro-operations to be squashed before the routine executes.
  • Platform mechanisms: Intel TSX provides transactional execution with atomic commit on success and rollback to a prior architectural state when an issue causes an abort.This execution model is part of the processor background relevant to transient attacks.
  • Platform mechanisms: Intel SGX isolates trusted enclave code through hardware while assuming the operating system and other applications may be compromised.Enclave entry, exit, interruption, and register restoration are handled by dedicated instructions and save-state areas.

3 ATTACK OVERVIEW

ZombieLoad is a novel data-sampling attack that exploits stale values returned during internally re-issued loads, using microarchitectural side effects to recover data without address-based target selection.

  • Classification: ZombieLoad combines incidental time-domain sampling with traditional side-channel primitives to construct targeted leakage in the address domain.The paper presents this as a new category of memory-based side-channel attack, termed Meltdown-MCA in its classification.
  • Attack mechanism: ZombieLoad targets the fill buffer, which is shared across logical CPUs and does not distinguish processes or privilege levels.The attack observes memory-load values on the current physical CPU.
  • Attack mechanism: Faulting or microarchitecturally assisted loads may transiently read stale values before re-issue, allowing the attacker to encode them through a cache covert channel.The pipeline later rolls back architectural effects, but microarchitectural side effects remain observable.
  • Target control: ZombieLoad leaks values currently loaded by the physical CPU core rather than values selected through an attacker-specified address.This lack of address control is a limitation relative to earlier Meltdown-type attacks.
  • Microarchitectural root cause: The proposed stale-entry explanation remains unverified because the authors observed leakage only on Intel CPUs and lacked sufficient official fill-buffer documentation.They leave confirmation or falsification of the hypothesis to future work.
  • Classification: ZombieLoad introduces data-sampling attacks, connecting an instruction pointer with the data value of a memory access.The paper argues that this class can affect side-channel-resistant applications such as constant-time cryptographic algorithms.

4 ATTACK SCENARIOS & ATTACKER MODEL

The paper evaluates ZombieLoad under attacker models spanning user processes, kernels, virtual machines, hypervisors, and SGX enclaves, generally assuming Intel CPUs with hyperthreading enabled. These scenarios demonstrate leakage across processes, privilege boundaries, logical cores, and virtualization boundaries, with SGX attacks recovering enclave secrets.

  • Attacker model: The baseline attacker executes unprivileged native code on an Intel CPU with simultaneous multithreading enabled.The model assumes a trusted operating system unless a scenario specifies stronger attacker capabilities.
  • User-Space Leakage: Cross-process leakage allows an unprivileged attacker on a different logical core to observe values loaded by a concurrently running user-space application.The paper identifies browsers and password managers as likely locations of user-space secrets.
  • Kernel Leakage: ZombieLoad leaks kernel loads to an unprivileged attacker on the same or a sibling logical core.Kernel-load leakage may survive the transition back to user space, so hyperthreading is not strictly required in this scenario.
  • Intel SGX Leakage: A sibling logical core can leak secrets loaded during concurrent SGX-enclave execution, including a recovered 128-bit sealing key.The authors did not observe leakage on the same logical core after synchronous enclave exit.
  • Virtual Machine Leakage: An attacker inside one virtual machine can leak values loaded by a co-located virtual machine running on a sibling logical core.The untrusted guest can modify guest-page-table entries.
  • Hypervisor Leakage: A virtual-machine attacker can use ZombieLoad to leak values loaded by the hypervisor.This scenario permits more than unprivileged guest-code execution.

5 BUILDING BLOCKS

ZombieLoad is built from loads that internally fault and are re-issued, allowing transient access to stale data held in fill-buffer entries. Its variants use flushed or microcode-assisted memory accesses and can sample data across processes, privilege boundaries, and logical cores.

  • Zombie Loads: Zombie loads are memory loads that fault architecturally or microarchitecturally, trigger a microcode assist, and require internal re-issue.The attack uses a transient load that computes on wrong data during this process.
  • Attack Variants: Both variants use clflush or clflushopt to create conditions for leaking from an unintended destination.Variant 1 reads through the kernel address, whereas Variant 2 transiently reads through the second virtual address.
  • Data Sampling: Stale values come from data currently loaded on the current or sibling logical CPU, because ZombieLoad reuses fill-buffer entries rather than reading the targeted page.Each variant can access all bytes from the referenced cache line.
  • Data Sampling: Although the attacker cannot select the leaked address, the least-significant 6 bits of the virtual address select a byte within the 64 B fill-buffer entry.This enables byte-by-byte leakage of sensitive data such as AES keys.
  • Evaluation: ZombieLoad samples data across processes, privilege boundaries, and logical cores, including kernel, hypervisor, and SGX enclave data.The evaluation tested CPUs from Sandy Bridge through Cascade Lake, with both variants working on different microarchitectures except Whiskey Lake, Coffee Lake-R, and Cascade Lake-SP.

6 CASE STUDY ATTACKS

The case studies demonstrate ZombieLoad across cryptographic keys, covert channels, SGX secrets, browser behavior, and targeted leakage. These attacks combine transient data sampling with filtering or reconstruction techniques to recover protected or patterned data.

  • 6.1 AES-NI Key Leakage: The Domino attack combines bits from adjacent AES-key bytes to reduce noise from unrelated loads.The transient domain can compute on the full AES key, enabling specially crafted domino bytes and post-processing.
  • 6.1 AES-NI Key Leakage: ZombieLoad recovers an AES-128 key in under 10 s from a victim using AES-NI.The victim loaded the key approximately 10,000 times during the attack.
  • 6.2 SGX Sealing Key Extraction: ZombieLoad extracts SGX sealing keys and recovers register values from enclave execution, including a full 128-bit sealing key.In benchmark experiments, the full key appeared among candidates 30% of the time, while the exact key was recovered 3% of the time.
  • 6.3 Cross-VM Covert Channel: Transient-domain error detection filters noise before architectural transmission, supporting error-free covert channels with rates up to 26.8 kbit/s.The cloud scenario achieved 1.99 kbit/s with Variant 1 and signal handling when TSX was unavailable.
  • 6.4 Browsing-Behavior Monitoring: ZombieLoad fingerprints browser content and monitors browsing behavior through keyword detection and URL recovery attacks.The number of reloads depends on the website: static pages require approximately ten times more reloads than highly dynamic pages.
  • 6.5 Targeted Data Leakage: ZombieLoad supports targeted leakage from speculative loads and prefetches, while simple out-of-bounds accesses can provide sufficient gadgets.Kernel-memory recovery reached 38% accuracy after 10 s per byte and 72% for 7-bit ASCII with prior knowledge.

7 COUNTERMEASURES

The paper evaluates software and hardware countermeasures for ZombieLoad, finding that no single general strategy fully prevents leakage across all protection boundaries.

  • Disabling hyperthreading is a straightforward mitigation, but it may incur unacceptable performance impact because hyperthreading improves some workloads by 30 % to 40 %.The attack leaks loaded values across logical cores, directly motivating this workaround.
  • Co-scheduling can prevent leaks between user processes, but kernel–user protection requires sibling logical cores to enter the kernel together.The same scheduling principle applies analogously to hypervisors and virtual machines.
  • Disabling hyperthreading or co-scheduling is insufficient because ZombieLoad also works across protection boundaries on a single logical core.The authors found no reliable instruction sequence that prevents this leakage; flushing L1 and load stuffing are insufficient.
  • Selective feature deactivation can impair some attack variants, but Variant 1 remains possible when an attacker can identify an alias mapping of an accessible user page in the kernel.The paper also recommends disabling VT-x on systems that do not need virtual machines.
  • Other mitigations include neutralizing prefetch gadgets, preventing sensitive mappings, secret sharing, and filtering clflush in sandboxes.Speculative Load Hardening incurs a performance overhead of 10 % to 50 % for typical applications.

8 CONCLUSION

The paper presents ZombieLoad as a fill-buffer attack that leaks recently loaded values across processes, privilege rings, virtual machines, and SGX enclaves. It demonstrates broad attack consequences and concludes that disabling hyperthreading is the only possible workaround on current processors.

  • ZombieLoad targets the processor’s fill-buffer logic and leaks recently loaded values used by the current or sibling logical CPU.The demonstrated leakage spans user-space processes, CPU protection rings, virtual machines, and SGX enclaves.
  • The demonstrated attack potential includes monitoring browser behaviour, extracting AES keys, establishing cross-VM covert channels, and recovering SGX sealing keys.
  • The authors conclude that disabling hyperthreading is the only possible workaround to mitigate ZombieLoad on current processors.

A FILL-BUFFER SIZE

The experiments measure how many fill-buffer entries logical cores can use and compare behavior across processor generations and sharing conditions.

  • Intel describes the fill buffer as competitively shared during hyperthreading, with 10 expected entries per logical core on Sandy Bridge and newer microarchitectures.
  • The experiment times n stores to DRAM for n = 1, . . . , 20 using non-temporal stores that bypass the cache and directly access DRAM.Experiments were repeated 1 000 000 times, using minimum latency to reduce noise.
  • 12 stores mark the latency increase when either one isolated logical core runs alone or both isolated logical cores run in parallel.This indicates that both logical cores can leverage the entire 12-entry fill buffer.
  • 10 entries are measured on pre-Skylake CPUs, while 12 entries are measured on Skylake and newer microarchitectures.The Skylake-and-newer measurement differs from Intel’s documented number.
  • Because both logical cores can leverage the entire fill buffer, every logical core can potentially use any fill-buffer entry.
Loading 1905.05726v1…