CPU bugs, CPU backdoors and consequences on security

Abstract

In this paper, we present the security implications of x86 processor bugs or backdoors on operating systems and virtual machine monitors. We will not try to determine whether the backdoor threat is realistic or not, but we will assume that a bug or a backdoor exists and analyze the consequences on systems. We will show how it is possible for an attacker to implement a simple and generic CPU backdoor in order-at some later point in time-to bypass mandatory security mechanisms with very limited initial privileges. We will explain practical difficulties and show proof of concept schemes using a modified Qemu CPU emulator. Backdoors studied in this paper are all usable from the software level without any physical access to the hardware.

Specs

“…Existing work on processor bugs as security vulnerabilities takes the approach of finding a single processor bug and realizing a usable software-level attack with that bug as a foothold [3,11,12,23]. While this level of analysis highlights the threat of a specific security-critical processor bug, it does not give an idea of how pervasive security-critical bugs are, their range of effects, or what they have in common.…”

“…11 Jump and link instructions store the address of the instruction immediately following the delay slot instruction to the link register (LR). 12 The reserved bits of a given instruction are set to 0 for each instruction encoding class 13 The address of the current instruction is the address of the previous instruction plus four. This invariant is a building block used to trigger other invariants that verify control flow discontinuities.…”

Towards reducing the attack surface of software backdoors

“…Over the last few years, the security community has mainly focused on backdoors in integrated circuits and ways to detect or implement such hardware backdoors [6,19,21,24,33,34,36]. Furthermore, several backdoors in different components of a computer such as network cards [32] or directly in the CPU [14] were proposed. Our approach is orthogonal to such work since we focus on the detection of backdoors on the binary level, an area that has received almost no attention so far.…”

Enforcing kernel constraints by hardware-assisted virtualization

“…The hardware components on which the kernel depends to execute itself do not contain exploitable bugs, backdoors or undocumented functions [6] with regard to security.…”

“…So it involves the MCH. These access vectors can be divided in two categories depending on whether the access is initiated by the device or ordered by the CPU: 6 • In the case the access is initiated by the device, it concerns the devices that are connected on a bus capable of bus mastering (like the PCI or PCI Express bus on IA-32 and Intel 64 architectures). These devices can then take control of the bus and perform a data transfer to the memory without the processor involvement.…”