SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution

Abstract

This paper presents SgxPectre Attacks that exploit the recently disclosed CPU bugs to subvert the confidentiality and integrity of SGX enclaves. Particularly, we show that when branch prediction of the enclave code can be influenced by programs outside the enclave, the control flow of the enclave program can be temporarily altered to execute instructions that lead to observable cache-state changes. An adversary observing such changes can learn secrets inside the enclave memory or its internal registers, thus completely defeating the confidentiality guarantee offered by SGX. To demonstrate the practicality of our SgxPectre Attacks, we have systematically explored the possible attack vectors of branch target injection, approaches to win the race condition during enclave's speculative execution, and techniques to automatically search for code patterns required for launching the attacks. Our study suggests that any enclave program could be vulnerable to SgxPectre Attacks since the desired code patterns are available in most SGX runtimes (e.g., Intel SGX SDK, Rust-SGX, and Graphene-SGX). Most importantly, we have applied SgxPectre Attacks to steal seal keys and attestation keys from Intel signed quoting enclaves. The seal key can be used to decrypt sealed storage outside the enclaves and forge valid sealed data; the attestation key can be used to forge attestation signatures. For these reasons, SgxPectre Attacks practically defeat SGX's security protection. This paper also systematically evaluates Intel's existing countermeasures against SgxPectre Attacks and discusses the security implications.

SPEECHMINER: A Framework for Investigating and Measuring Speculative Execution Vulnerabilities

“…Spectre v2 [17] targets BTB storing the branch targets of indirect branch instructions. SGXPectre [6] makes use of this variant to steal secret from SGX enclaves. • Return Stack Buffer (RSB).…”

Trustee: Full Privacy Preserving Vickrey Auction on Top of Ethereum

“…We acknowledge that several recent studies have uncovered side-channel attacks to compromise the confidentiality of Intel SGX [13,19,23,28,29,31]. Also, multiple mitigation techniques have been proposed to address attack-specific issues [18,[24][25][26].…”

IRONHIDE: A Secure Multicore that Efficiently Mitigates Microarchitecture State Attacks for Interactive Applications

“…Performance degradation of ∼40% is reported for a database application generating 200K requests per second to the untrusted OS. Moreover, various microarchitecture state leakage channels in SGX have led to security vulnerabilities [16], [17].…”

“…The performance of an SGX-like enclave setup suffers by ∼33% since it incurs overheads associated with pipeline flushing and cryptography operations on every secure enclave entry and exit. Moreover, due to temporal execution of the secure enclave with insecure processes, an attacker process can either directly monitor accesses made by the enclave [1], [4], [16], or befuddle the system in making speculative accesses [5], [6], [17] to leak secure enclave's data.…”