{
  "url": "https://fahrplan.events.ccc.de/rc3/2020/Fahrplan/events/11365.html",
  "id": 11365,
  "guid": "3a543c0f-abcc-4b07-aeff-c8051fabc838",
  "logo": "/system/events/logos/000/011/365/large/logo.png?1605175843",
  "date": "2020-12-27T19:10:00+01:00",
  "start": "19:10",
  "duration": "00:40",
  "room": "chaosstudio-hamburg",
  "slug": "rc3-11365-lvi_hijacking_transient_execution_through_microarchitectural_load_value_injection",
  "title": "LVI: Hijacking Transient Execution through Microarchitectural Load Value Injection",
  "subtitle": "",
  "track": "IT-Security",
  "type": "Talk",
  "language": "en",
  "abstract": "Load Value Injection (LVI) is a new class of transient-execution attacks exploiting microarchitectural flaws in modern processors to inject attacker data into a victim program and steal sensitive data and keys from Intel SGX, a secure vault in Intel processors for your personal data. ",
  "description": "Since 2018, we have seen an alarming wave of Meltdown-type attacks: from the\r\noriginal Meltdown, breaking kernel isolation, over Foreshadow, breaking virtual\r\nmachine and SGX enclave isolation, to most recently ZombieLoad, breaking\r\nessentially all of these. All of these attacks exploit CPU vulnerabilities to\r\nleak data, breaking basically all confidentiality guarantees of CPUs. Luckily,\r\nthere are already widely deployed countermeasures -- either in hardware or\r\nsoftware -- preventing exploitation of these attacks.\r\n\r\nIn this talk, we show that despite all countermeasures, the Meltdown effect can\r\nbe turned around to inject attacker-controlled data into the microarchitectural\r\nstate of any application. This technique, called Load Value Injection (LVI),\r\nsmuggles the attacker's data through hidden processor buffers into a victim\r\nprogram and allows to hijack both transient control flow as well as the data\r\nflow. By forcing a (microarchitectural) fault in the victim, the victim\r\ntransiently calculates on maliciously injected data. Especially in the case of\r\ntrusted execution environments, such as Intel SGX, where an attacker has full\r\ncontrol of the operating system, adversaries can easily trigger a fault in the\r\nvictim and leak arbitrary enclave secrets. We show that this can be exploited\r\nfor all CPUs that were affected by some variant of Meltdown.\r\nAs a result, we can bypass existing Meltdown countermeasures,\r\narbitrarily change control flow, and let the application work on\r\nattacker-controlled data.\r\n\r\nWe outline the drastic consequences for affected CPUs. After nearly 1\r\nyear of embargo, fully mitigating our attacks requires serializing the\r\nprocessor pipeline with memory fence instructions after possibly every\r\nmemory load. Additionally and even worse, due to implicit loads on some\r\narchitectures, specific instructions have to be blacklisted, including\r\nthe ubiquitous x86 ret instruction. Intel's compiler mitigations lead to\r\nperformance impacts of factor 2 to 19. In a demo, we show how LVI can be\r\nused to leak a cryptographic key.\r\n\r\nFor more information about our work, including demo videos and a\r\ntrailer, see: <https://lviattack.eu/>\r\n\r\nA technical paper about this work appeared at IEEE S&P 2020 and is\r\navailable here: <https://lviattack.eu/lvi.pdf>\r\n",
  "recording_license": "",
  "do_not_record": false,
  "persons": [
    {
      "id": 12439,
      "public_name": "Jo Van Bulck"
    },
    {
      "id": 8665,
      "public_name": "Michael Schwarz"
    }
  ],
  "links": [
    {
      "url": "https://lviattack.eu/",
      "title": "Homepage"
    },
    {
      "url": "https://software.intel.com/security-software-guidance/deep-dives/deep-dive-load-value-injection",
      "title": "Intel Deep Dive"
    },
    {
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00334.html",
      "title": "Intel Security Advisory"
    },
    {
      "url": "https://youtu.be/baKHSXeIIaI",
      "title": "Inception-inspired trailer video"
    }
  ],
  "attachments": [
    {
      "url": "/system/event_attachments/attachments/000/004/149/original/lvi.pdf?1605175843",
      "title": "Technical paper"
    }
  ],
  "room_id": "008e96f4-1a64-46d3-af2e-7ae75fed1763",
  "origin": null
}