AsyncShock: Exploiting Synchronisation Bugs in Intel SGX Enclaves

Abstract

Abstract. Intel's Software Guard Extensions (SGX) provide a new hardware-based trusted execution environment on Intel CPUs using secure enclaves that are resilient to accesses by privileged code and physical attackers. Originally designed for securing small services, SGX bears promise to protect complex, possibly cloud-hosted, legacy applications. In this paper, we show that previously considered harmless synchronisation bugs can turn into severe security vulnerabilities when using SGX. By exploiting use-after-free and time-of-check-to-time-of-use (TOCTTOU) bugs in enclave code, an attacker can hijack its control flow or bypass access control. We present AsyncShock, a tool for exploiting synchronisation bugs of multithreaded code running under SGX. AsyncShock achieves this by only manipulating the scheduling of threads that are used to execute enclave code. It allows an attacker to interrupt threads by forcing segmentation faults on enclave pages. Our evaluation using two types of Intel Skylake CPUs shows that AsyncShock can reliably exploit use-after-free and TOCTTOU bugs.

Component integrity guarantees in software-defined networking infrastructure

“…SGX is a novel technology under continuous development and intense security research scrutiny. [20] exposes vulnerability exploits synchronization bugs to circumvent the security guarantees of SGX and to hijack the control flow of the enclave code or even bypass access control mechanisms. In [21], Buhren et al described a so-called fault attack, allowing an attacker to change the contents of the RAM encrypted area.…”

TrustJS

“…Furthermore, side-channel attacks [37,36] based on vulnerabilities of the application running inside the enclave are not of interest: We assume all enclave software to be free of security-relevant bugs. Finally, we assume the design and implementation of SGX itself, including all cryptographic operations is secure and does not contain any vulnerabilities.…”

Avoiding Leakage and Synchronization Attacks through Enclave-Side Preemption Control

“…We now turn to the exploitation of concurrency bugs for the purpose of violating enclave integrity as demonstrated by Weichbrodt et al [13]. The attack proceeded by widening the window of vulnerability during which race conditions Figure 4: use-after-free concurrency bug lead to wrong synchronization behavior.…”

“…However, running critical sections under DP protection helps preventing the exploitation of these bugs. We illustrate this on the example of the use-after-free concurrency bug from [13], which we depict in Fig. 4.…”

“…Unfortunately, the current version of SGX fails to implement this protection in a tamperproof manner as has been demonstrated in two recent publications: (i) Xu et al [14] managed to extract significant amounts of confidential data (whole images) from enclaves by carefully paging enclaves to observe their control flow; (ii) Weichbrodt et al [13] carefully controlled the scheduling of enclave threads to trigger concurrency bugs in enclave-protected applications. Both attacks come from the fact that SGX allows the management OS to preempt the execution of enclaves at arbitrary points in time.…”