Dark Mode
Capec-663 Detail
Exploitation of Transient Instruction Execution
Standard Software Hardware Software Likelihood: Low Typical Severity: Very High
Parents: 74 184
Children: 696
An adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution to expose sensitive data and bypass/subvert access control over restricted resources. Typically, the adversary conducts a covert channel attack to target non-discarded microarchitectural changes caused by transient executions such as speculative execution, branch prediction, instruction pipelining, and/or out-of-order execution. The transient execution results in a series of instructions (gadgets) which construct covert channel and access/transfer the secret data.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-663 | capec | https://capec.mitre.org/data/definitions/663.html | |
| CWE-1037 | cwe | http://cwe.mitre.org/data/definitions/1037.html | |
| CWE-1303 | cwe | http://cwe.mitre.org/data/definitions/1303.html | |
| CWE-1264 | cwe | http://cwe.mitre.org/data/definitions/1264.html | |
| REF-637 | reference_from_CAPEC | https://spectreattack.com/spectre.pdf | Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, Yuval Yarom, Spectre Attacks: Exploiting Speculative Execution, 2019, Graz University of Technology |
| REF-638 | reference_from_CAPEC | https://meltdownattack.com/meltdown.pdf | Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, Mike Hamburg, Meltdown: Reading Kernel Memory from User Space, 2018, Graz University of Technology |
| REF-639 | reference_from_CAPEC | https://arxiv.org/abs/1811.05441 | Claudio Canella, Jo Van Bulck, Michael Schwarz, Moritz Lipp, Benjamin von Berg, Philipp Ortner, Frank Piessens, Dmitry Evtyushkin, Daniel Gruss, A Systematic Evaluation of Transient Execution Attacks and Defenses, 2019--05---15, Graz University of Technology |
| REF-640 | reference_from_CAPEC | https://eprint.iacr.org/2016/613.pdf | Qian Ge, Yuval Yarom, Gernot Heiser, A Survey of Microarchitectural Timing Attacks and Countermeasures on Contemporary Hardware, 2016--12---26, Journal of Cryptographic Engineering |
| REF-641 | reference_from_CAPEC | https://spectrum.ieee.org/computing/hardware/how-the-spectre-and-meltdown-hacks-really-worked | Nael Abu-Ghazaleh, Dmitry Ponomarev, Dmitry Evtyushkin, How the Spectre and Meltdown Hacks Really Worked, 2019--02---28, IEEE Spectrum |
| REF-642 | reference_from_CAPEC | https://spectrum.ieee.org/computing/hardware/how-the-spectre-and-meltdown-hacks-really-worked | James Sanders, Spectre and Meltdown explained: A comprehensive guide for professionals, 2019--05---15, TechRepublic |
| REF-643 | reference_from_CAPEC | https://us-cert.cisa.gov/ncas/alerts/TA18-004A | Alert (TA18-004A) Meltdown and Spectre Side-Channel Vulnerability Guidance, 2018--01---04, CISA |
Explore
-
Survey target application and relevant OS shared code libraries: Adversary identifies vulnerable transient instruction sets and the code/function calls to trigger them as well as instruction sets or code fragments (gadgets) to perform attack.
-
Explore cache and identify impacts: Utilize tools to understand the impact of transient instruction execution upon address spaces and CPU operations.
| Techniques |
|---|
| Utilize Disassembler and Debugger tools to examine and trace instruction set execution of source code and shared code libraries on a system. |
| Techniques |
|---|
| Run OS or application specific tools that examine the contents of cache. |
Experiment
-
Cause conditions for identified transient instruction set execution: Adversary ensures that specific code/instructions of the target process are executed by CPU, so desired transient instructions are executed.
-
Cause specific secret data to be cached from restricted address space: Executed instruction sets (gadgets) in target address space, initially executed via adversary-chosen transient instructions sets, establish covert channel and transfer secret data across this channel to cache.
| Techniques |
|---|
| Prediction-based - adversary trains CPU to incorrectly predict/speculate conditions for instruction execution to be true, hence executing adversary-chosen transient instructions. These prediction-based methods include: Pattern History Table (PHT)/Input Validation Bypass, Branch Target Buffer (BTB)/Branch Target Injection, Return Stack Buffer (RSB)/Return Address Injection, and Store To Load (STL)/Speculative Store Bypass. |
| Exception/Fault-based - adversary has CPU execute transient instructions that raise an exception allowing inaccessible memory space to be accessed via out-of-order execution. These exception/fault-based methods include: Supervisor-only Bypass, Virtual Translation Bypass, System Register Bypass, FPU Register Bypass, Read-only Bypass, Protection Key Bypass, and Bounds Check Bypass. |
Exploit
-
Perform covert channel attack to obtain/access secret data: Adversary process code removes instructions/data from shared cache set, waits for target process to reinsert them back into cache, to identify location of secret data via a timing method. Adversary continuously repeat this process to identify and access entirety of targeted secret data.
| Techniques |
|---|
| Flush+Reload - adversary frequently flushes targeted memory cache line using a dedicated machine flush instruction, and uses another process to measure time taken for CPU to load victim secret data. |
| Evict+Time - adversary causes victim to load target set into cache and measures time for victim process to load this data, setting a baseline. Adversary evicts a specified cache line and causes victim process to execute again, and measures any change in execution time, to determine if cache line was accessed. |
| Prime+Probe - adversary primes cache by filling cache line(s) or set(s) with data, after some time victim process evicts this adversary data to replace it with secret data. The adversary then probes/accesses all the previously accessed cache lines detecting cache misses, which determine that their attacker data has been evicted and replaced with secret data from victim process. |
- The adversary needs at least user execution access to a system and a maliciously crafted program/application/process with unprivileged code to misuse transient instruction set execution of the CPU.
- C2C mechanism or direct access to victim system, capable of dropping malicious program and collecting covert channel attack data.
- Malicious program capable of triggering execution of transient instructions or vulnerable instruction sequences of victim program and performing a covert channel attack to gather data from victim process memory space. Ultimately, the speed with which an attacker discovers a secret is directly proportional to the computational resources of the victim machine.
| High |
|---|
| Detailed knowledge on compiled binaries and operating system shared libraries of instruction sequences, and layout of application and OS/Kernel address spaces for data leakage. |
| Authorization | Access Control | Confidentiality |
|---|---|---|
| Execute Unauthorized Commands | Bypass Protection Mechanism | Read Data |
- A web browser with user-privileges executes JavaScript code imbedded within a malicious website. The system does not disable shared buffers for the web browser and there is no restriction or check upon user-process execution of flush or evict instructions. The Javascript code executes vulnerable transient instructions upon system to cause microarchitectural changes that establish covert channel and transfer sensitive/secret data into shared cache from address space of either kernel, web browser or another executing process on the system.