Foreshadow (security vulnerability)

From HandWiki
Foreshadow
Foreshadow logo with narrow text.svg
A logo created for the vulnerability, featuring a lock with a shadow.
CVE identifier(s)CVE-2018-3615 (Foreshadow), CVE-2018-3620 and CVE-2018-3646 (Foreshadow-NG)
Date discoveredJanuary 2018; 6 years ago (2018-01)
Affected hardwareModern Intel processors

Foreshadow (known as L1 Terminal Fault (L1TF) by Intel)[1][2] is a vulnerability that affects modern microprocessors that was first discovered by two independent teams of researchers in January 2018, but was first disclosed to the public on 14 August 2018.[18] The vulnerability is a speculative execution attack on Intel processors that may result in the disclosure of sensitive information stored in personal computers and third-party clouds.[1] There are two versions: the first version (original/Foreshadow) (CVE-2018-3615) targets data from SGX enclaves; and the second version (next-generation/Foreshadow-NG) (CVE-2018-3620 and CVE-2018-3646) targets virtual machines (VMs), hypervisors (VMM), operating systems (OS) kernel memory, and System Management Mode (SMM) memory.[1] A listing of affected Intel hardware has been posted.[11][12]

Foreshadow is similar to the Spectre security vulnerabilities discovered earlier to affect Intel and AMD chips, and the Meltdown vulnerability that also affected Intel.[7] However, AMD products, according to AMD, are not affected by the Foreshadow security flaws.[7] According to one expert, "[Foreshadow] lets malicious software break into secure areas that even the Spectre and Meltdown flaws couldn't crack".[16] Nonetheless, one of the variants of Foreshadow goes beyond Intel chips with SGX technology, and affects "all [Intel] Core processors built over the last seven years".[3]

Foreshadow may be very difficult to exploit,[3][7] and there seems to be no evidence to date (15 August 2018) of any serious hacking involving the Foreshadow vulnerabilities.[3][7] Nevertheless, applying software patches may help alleviate some concern, although the balance between security and performance may be a worthy consideration.[6] Companies performing cloud computing may see a significant decrease in their overall computing power; individuals, however, may not likely see any performance impact, according to researchers.[10] The real fix, according to Intel, is by replacing today's processors.[6] Intel further states, "These changes begin with our next-generation Intel Xeon Scalable processors (code-named Cascade Lake),[19][20] as well as new client processors expected to launch later this year [2018]."[6]

On 16 August 2018, researchers presented technical details of the Foreshadow security vulnerabilities in a seminar, and publication, entitled "Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution"[21] at a USENIX security conference.[9][21]

History

Two groups of researchers discovered the security vulnerabilities independently: a Belgian team (including Jo Van Bulck, Frank Piessens, Raoul Strackx) from imec-DistriNet, KU Leuven reported it to Intel on 3 January 2018; a second team from Technion – Israel Institute of Technology (Marina Minkin, Mark Silberstein), University of Adelaide (Yuval Yarom), and University of Michigan (Ofir Weisse, Daniel Genkin, Baris Kasikci, Thomas F. Wenisch) reported it on 23 January 2018.[1][4] The vulnerabilities were first disclosed to the public on 14 August 2018.[1][4]

Mechanism

The Foreshadow vulnerability is a speculative execution attack on Intel processors that may result in the disclosure of sensitive information stored in personal computers and third-party clouds.[1] There are two versions: the first version (original/Foreshadow) (CVE-2018-3615 [attacks SGX]) targets data from SGX enclaves; and the second version (next-generation/Foreshadow-NG) (CVE-2018-3620 [attacks the OS Kernel and SMM mode] and CVE-2018-3646 [attacks virtual machines]) targets virtual machines (VMs), hypervisors (VMM), operating systems (OS) kernel memory, and System Management Mode (SMM) memory.[1] Intel considers the entire class of speculative execution side channel vulnerabilities as "L1 Terminal Fault" (L1TF).[1]

For Foreshadow, the sensitive data of interest is the encrypted data in an SGX enclave. Usually, an attempt to read enclave memory from outside the enclave is made, speculative execution is permitted to modify the cache based on the data that was read, and then the processor is allowed to block the speculation when it detects that the protected-enclave memory is involved and reading is not permitted. However, "... if the sensitive data is in level 1 cache, speculative execution can use it before the processor determines that there's no permission to use it."[4] The Foreshadow attacks are stealthy, and leave few traces of the attack event afterwards in a computer's logs.[5]

On 16 August 2018, researchers presented technical details of the Foreshadow security vulnerabilities in a seminar, and publication,[21] at a USENIX security conference.[9][21]

Impact

Foreshadow is similar to the Spectre security vulnerabilities discovered earlier to affect Intel and AMD chips, and the Meltdown vulnerability that affected Intel.[7] AMD products, according to AMD, are not affected by the Foreshadow security flaws.[7] According to one expert, "[Foreshadow] lets malicious software break into secure areas that even the Spectre and Meltdown flaws couldn't crack".[16] Nonetheless, one of the variants of Foreshadow goes beyond Intel chips with SGX technology, and affects "all [Intel] Core processors built over the last seven years".[3]

Intel notes that the Foreshadow flaws could produce the following:[6]

  • Malicious applications, which may be able to infer data in the operating system memory, or data from other applications.
  • A malicious guest virtual machine (VM) may infer data in the VM's memory, or data in the memory of other guest VMs.
  • Malicious software running outside of SMM may infer data in SMM memory.
  • Malicious software running outside of an Intel SGX enclave or within an enclave may infer data from within another Intel SGX enclave.

According to one of the discoverers of the computer flaws: "... the SGX security hole can lead to a "Complete collapse of the SGX ecosystem."[6]

A partial listing of affected Intel hardware has been posted, and is described below.[11][12] (Note: a more detailed - and updated - listing of affected products is on the official Intel website.[11])

  • Intel Core i3/i5/i7/M processor (45 nm and 32 nm)
  • 2nd/3rd/4th/5th/6th/7th/8th generation Intel Core processors
  • Intel Core X-series processor family for Intel X99 and X299 platforms
  • Intel Xeon processor 3400/3600/5500/5600/6500/7500 series
  • Intel Xeon Processor E3 v1/v2/v3/v4/v5/v6 family
  • Intel Xeon Processor E5 v1/v2/v3/v4 family
  • Intel Xeon Processor E7 v1/v2/v3/v4 family
  • Intel Xeon Processor Scalable family
  • Intel Xeon Processor D (1500, 2100)

Foreshadow may be very difficult to exploit,[3][7] and there seems to be no evidence to date (15 August 2018) of any serious hacking involving the Foreshadow vulnerabilities.[3][7]

Mitigation

Applying software patches may help alleviate some concern(s), although the balance between security and performance may be a worthy consideration.[6][22] Companies performing cloud computing may see a significant decrease in their overall computing power; individuals, however, may not likely see any performance impact, according to researchers.[10]

The real fix, according to Intel, is by replacing today's processors.[6] Intel further states, "These changes begin with our next-generation Intel Xeon Scalable processors (code-named Cascade Lake),[19][20] as well as new client processors expected to launch later this year [2018]."[6]

See also

References

  1. ↑ 1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 "Foreshadow - Breaking the Virtual Memory Abstraction with Transient Out-of-Order Execution". ForeShadowAttack.eu. 14 August 2018. https://foreshadowattack.eu/. 
  2. ↑ https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault
  3. ↑ 3.0 3.1 3.2 3.3 3.4 3.5 3.6 Kan, Michael (14 August 2018). "New 'Foreshadow' Flaw Exploits Intel Chips To Steal Protected Data - The new vulnerability builds on research related to the Meltdown and Spectre flaws. Foreshadow can be exploited to read data from Intel's SGX technology, while a separate variant can break the security protections in data centers that run virtual machines.". PC Magazine. https://www.pcmag.com/news/363105/new-foreshadow-flaw-exploits-intel-chips-to-steal-protecte. 
  4. ↑ 4.0 4.1 4.2 4.3 Bright, Peter (14 August 2018). "Intel's SGX blown wide open by, you guessed it, a speculative execution attack - Speculative execution attacks truly are the gift that keeps on giving.". Ars Technica. https://arstechnica.com/gadgets/2018/08/intels-sgx-blown-wide-open-by-you-guessed-it-a-speculative-execution-attack/. 
  5. ↑ 5.0 5.1 Newman, Lily Hay (14 August 2018). "Spectre-like Flaw Undermines intel Processors' Most Secure Element". Wired. https://www.wired.com/story/foreshadow-intel-secure-enclave-vulnerability/. 
  6. ↑ 6.0 6.1 6.2 6.3 6.4 6.5 6.6 6.7 6.8 Vaughan-Nichols, Steven J. (14 August 2018). "Beyond Spectre: Foreshadow, a new Intel security problem - Researchers have broken Intel's Software Guard Extensions, System Management Mode, and x86-based virtual machines.". ZDNet. https://www.zdnet.com/article/beyond-spectre-foreshadow-a-new-intel-security-problem/. 
  7. ↑ 7.0 7.1 7.2 7.3 7.4 7.5 7.6 7.7 7.8 Giles, Martin (14 August 2018). "Intel's 'Foreshadow' flaws are the latest sign of the chipocalypse". MIT Technology Review. https://www.technologyreview.com/the-download/611879/intels-foreshadow-flaws-are-the-latest-sign-of-the-chipocalypse/. 
  8. ↑ Masters, Jon (14 August 2018). "Understanding L1 Terminal Fault aka Foreshadow: What you need to know". Red Hat. https://www.redhat.com/en/blog/understanding-l1-terminal-fault-aka-foreshadow-what-you-need-know. 
  9. ↑ 9.0 9.1 9.2 Chirgwin, Richard (15 August 2018). "Foreshadow and Intel SGX software attestation: 'The whole trust model collapses' - El Reg talks to Dr Yuval Yarom about Intel's memory leaking catastrophe". The Register. https://www.theregister.co.uk/2018/08/15/foreshadow_sgx_software_attestations_collateral_damage/. 
  10. ↑ 10.0 10.1 10.2 Lee, Dave (15 August 2018). "'Foreshadow' attack affects Intel chips". BBC News. https://www.bbc.com/news/technology-45191697. 
  11. ↑ 11.0 11.1 11.2 11.3 Staff (14 August 2018). "Q3 2018 Speculative Execution Side Channel Update (Intel-SA-00161)". Intel. https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html. 
  12. ↑ 12.0 12.1 12.2 Armasu, Lucian (15 August 2018). "Intel Chips' List of Security Flaws Grows". Tom's Hardware. https://www.tomshardware.com/news/intel-chips-foreshadow-security-flaws,37608.html. 
  13. ↑ Kerner, Sean Michael (15 August 2018). "Intel SGX at Risk From Foreshadow Speculative Execution Attack - Another set of side-channel, speculative execution vulnerabilities have been publicly reported by security researchers; this time the vulnerabilities take specific aim at SGX secure enclave and hypervisor isolation boundaries.". eWeek. http://www.eweek.com/security/intel-sgx-at-risk-from-foreshadow-speculative-execution-attack. 
  14. ↑ Kennedy, John (15 August 2018). "A Foreshadow of security: What you need to know about new Intel chip flaws". Silicon Republic.com. https://www.siliconrepublic.com/enterprise/foreshadow-intel-vulnerabilities-chips-sgx. 
  15. ↑ Hachman, Mark (15 August 2018). "Foreshadow attacks Intel CPUs with Spectre-like tactics (but you're probably safe) - You should be protected from L1TF if your PC is patched and up to date.". PC World. https://www.pcworld.com/article/3297419/security/foreshadow-l1tf-is-a-speculative-execution-exploit-targeting-intel-core-chips.html. 
  16. ↑ 16.0 16.1 16.2 Hoffman, Chris (16 August 2018). "How to Protect Your PC From the Intel Foreshadow Flaws". How-To Geek. https://www.howtogeek.com/362797/how-to-protect-your-pc-from-the-intel-foreshadow-flaws/. 
  17. ↑ Constantin, Lucian (16 August 2018). "New Foreshadow Vulnerabilities Defeat Memory Defenses on Intel CPUs". SecurityBoulevard.com. https://securityboulevard.com/2018/08/new-foreshadow-vulnerabilities-defeat-memory-defenses-on-intel-cpus/. 
  18. ↑ [1][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17]
  19. ↑ 19.0 19.1 Cutress, Ian (19 August 2018). "Intel at Hot Chips 2018: Showing the Ankle of Cascade Lake". AnandTech. https://www.anandtech.com/show/13239/intel-at-hot-chips-2018-showing-the-ankle-of-cascade-lake. 
  20. ↑ 20.0 20.1 Alcorn, Paul (22 August 2018). "Intel Unveils Cascade Lake, In-Silicon Spectre And Meltdown Mitigations". Tom's Hardware. https://www.tomshardware.com/news/intel-cascade-lake-details-spectre-meltdown,37674.html. 
  21. ↑ 21.0 21.1 21.2 21.3 Van Bulck, Jo; Minkin, Marina; Weisse, Ofir; Genkin, Daniel; Kasikci, Baris; Piessens, Frank; Silberstein, Mark; Wenisch, Thomas F. et al. (16 August 2018). "Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution" (PDF). USENIX. https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-van_bulck.pdf. 
  22. ↑ Larabel, Michael (24 May 2019). "Benchmarking AMD FX vs. Intel Sandy/Ivy Bridge CPUs Following Spectre, Meltdown, L1TF, Zombieload". Phoronix. https://www.phoronix.com/scan.php?page=article&item=sandy-fx-zombieload&num=1. 

Further reading

External links




Retrieved from "https://handwiki.org/wiki/index.php?title=Foreshadow_(security_vulnerability)&oldid=77433"