Spectre Still a Threat, Hypervisors Vulnerable

Johannes Wikner emphasized that his ongoing research is driven by the persistent nature of these design flaws.

His talk is entirely focused on the continuing relevance and unaddressed issues surrounding Spectre, confirming its status as 'not dead yet' despite extensive past research.

Addressing microarchitectural design flaws frequently introduces a trade-off, leading to reduced processor performance. Johannes Wikner noted his reputation for identifying vulnerabilities, such as 'Redbleed' and 'SRSO,' which often necessitate performance-impacting mitigations.

His work primarily focuses on branch target injection, commonly known as Spectre variant 2, a complex vulnerability requiring intricate solutions that affect CPU speed.

The hierarchical trust model in computing, from hardware to applications, is fundamentally compromised by microarchitectural vulnerabilities. Each layer of the system must implicitly trust the layer beneath it, meaning a flaw at a lower level can undermine the integrity of all layers above.

Security research has increasingly focused on these hardware-level bugs over the last decade, as hardware design choices directly impact the confidentiality and security of the entire system.

These prediction buffers are remarkably large, comparable in size to L1 caches, and are crucial for the high-performance execution that defines contemporary processors.

The branch predictor acts as the 'secret sauce' that enables speculative execution, anticipating future instructions to keep the pipeline full. Modern CPU pipelines feature decoupled components, operating via independent queues, which inadvertently facilitates the mechanisms behind misprediction-based attacks. This design choice, while boosting performance, creates opportunities for transient execution flaws to be exploited.

Spectre attacks exploit branch mispredictions to hijack transient execution paths within a CPU. Around eight years ago, researchers discovered that not only could misspeculations occur, but attackers could actively 'mistrain' specific branch operations.

This mistraining allows attackers to inject arbitrary branch targets, thereby gaining control over the transient execution flow of any given branch. Such manipulation effectively hijacks the program's control flow, enabling the leakage of sensitive data. Branch speculation itself is a fundamental design feature, critical for maximizing processor performance.

In the hypervisor-guest threat model, an attacker (the guest) targets a victim (the hypervisor) by exploiting shared microarchitectural states. Key shared components include processor caches and predictor states, which can inadvertently bridge security domains.

Attackers can leverage this shared state by using the same virtual address, or an alias, to influence the victim's branch predictor. This manipulation causes the victim to inadvertently execute 'gadget' code, revealing secrets through observable cache timing differences.

The Return Stack Buffer (RSB) is a small, hardware-only buffer designed to store return addresses, analogous to how a program stack manages return targets. This microarchitectural component, typically holding 16-32 targets, significantly speeds up execution by eliminating the need for memory operations during function returns.

The CPU's front-end relies on the Branch Target Buffer (BTB) to predict the type of branch operation. Conflicts arising between the predicted branch type and the actual branch type can lead to 'branch type confusion,' opening avenues for exploitation.

Researchers discovered 'phantom branching,' a phenomenon where the system predicts a branch in code that contains no actual branch instructions. This occurs by forcing branch type information onto arbitrary instructions, such as NOPs.

This effect, where indirect or direct branch predictions manifest without a corresponding instruction, has been observed across modern hardware architectures. Phantom branching represents a specific form of branch type confusion that significantly extends the scope of speculative execution attacks, creating un intended execution paths.

Mitigation efforts against Spectre vary significantly across different hypervisors, with some demonstrating incomplete protections. For instance, FreeBSD's bhyve attempts partial RSB clearing but omits critical security measures.

VirtualBox, by contrast, appears to have implemented no substantial Spectre mitigations, making it particularly susceptible. Exploitation remains straightforward in environments where these mitigations are either incomplete or entirely absent.

The initial stage involves identifying the host system to locate its kernel image and the Virtual Machine Monitor (VMM) module.

Following host identification, the exploit establishes a covert channel, which necessitates finding a host memory reference that links into guest memory. These memory reference leaks are achieved through independent proof-of-concept stages, each building upon the previous one to gain more control.

After processing VM intercepts, the RSB becomes populated with host return addresses.

Guests can then trigger a return operation, forcing the CPU to predict a host address from the RSB. Instruction fetches for this predicted address are measured via cache hits, providing a means to infer the host's memory layout.

This process can target MMU address translation tables to reduce entropy and pinpoint specific host memory locations, thereby bypassing ASLR protections.

Johannes Wikner demonstrated the leakage of host information from a guest virtual machine. The demonstration targeted a FreeBSD environment running on AMD Ryzen hardware.

The process successfully exploited the Return Stack Buffer (RSB) to precisely locate the base address of the Virtual Machine Manager.

This initial step is critical for subsequent stages of an exploit, as it provides the necessary memory layout information for further attacks.

The exploit leverages a direct mapping of all RAM within the system, similar to Linux's `fist map`. FreeBSD provides an equivalent mechanism called 'direct map'.

This mapping allows an attacker to manipulate page tables and conduct cache-based analyses. The technique relies on flushing and reloading processor buffers to correlate cache hits with specific memory addresses, providing insight into the host's memory layout.

During the live demonstration, Johannes Wikner encountered a temporary failure, noting the unpredictability common in complex security demonstrations. The specific step that failed had not previously presented issues.

The successful execution of the exploit requires a precise sequencing of address identification and the careful setup of covert communication channels.

Johannes Wikner demonstrated a method to leak host kernel virtual address data from within a guest virtual machine. This process established a simple interface that could read from a given virtual address.

The exploit involves walking pointers, starting from the 'init task,' to locate target data structures within the host kernel. By traversing memory, the technique successfully identifies page caches and accesses sensitive data.

According to Wikner, the reality is that an unprivileged guest user in VirtualBox can infer arbitrary memory from the host system. He concluded that the corporate description serves to downplay the significant security risks posed by the vulnerability.