One Glitch to Rule Them All: Fault Injection Attacks Against AMD's Secure Encrypted Virtualization

Abstract

AMD Secure Encrypted Virtualization (SEV) offers protection mechanisms for virtual machines in untrusted environments through memory and register encryption. To separate security-sensitive operations from software executing on the main x86 cores, SEV leverages the AMD Secure Processor (AMD-SP). This paper introduces a new approach to attack SEV-protected virtual machines (VMs) by targeting the AMD-SP. We present a voltage glitching attack that allows an attacker to execute custom payloads on the AMD-SPs of all microarchitectures that support SEV currently on the market (Zen 1, Zen 2, and Zen 3). The presented methods allow us to deploy a custom SEV firmware on the AMD-SP, which enables an adversary to decrypt a VM's memory. Furthermore, using our approach, we can extract endorsement keys of SEV-enabled CPUs, which allows us to fake attestation reports or to pose as a valid target for VM migration without requiring physical access to the target host. Moreover, we reverse-engineered the Versioned Chip Endorsement Key (VCEK) mechanism introduced with SEV Secure Nested Paging (SEV-SNP). The VCEK binds the endorsement keys to the firmware version of TCB components relevant for SEV. Building on the ability to extract the endorsement keys, we show how to derive valid VCEKs for arbitrary firmware versions. With our findings, we prove that SEV cannot adequately protect confidential data in cloud environments from insider attackers, such as rogue administrators, on currently available CPUs.

Dropbear: Machine Learning Marketplaces made Trustworthy with Byzantine Model Agreement

“…A TEE leverages a root of trust from the hardware to shield the execution of sensitive computation and its data from the rest of the node, including higher privileged software layers. While TEEs have been proposed to make ML computation trustworthy [42,65,79,80], past TEE implementations have been shown to exhibit exploitable security vulnerabilities [12,78,84,111].…”

“…Slalom [109] and Privado [42] use trusted execution environment (TEEs) [22] to produce trustworthy inference. They rely on the security of TEEs, which have suffered from successful attacks [12,78,84,111]. These solutions are restricted to CPU-based inference, which increases latencies by several orders of magnitude compared to GPUs.…”

Electrical-Level Attacks on CPUs, FPGAs, and GPUs: Survey and Implications in the Heterogeneous Era

“…While virtualization can hinder some exploits by abstracting away details of the hardware and restricting access to some hardware-dependent interfaces, it does not necessarily provide full protection. For instance, if the adversary has hardware access, attacks which bypass the virtualization remain feasible [30]. The situation is not very different when the attacker has software access (e.g., RowHammer remains feasible [180]).…”