A new Spectre-like vulnerability of the CPU is aimed at the return buffer from the stack

A new Spectre-like vulnerability of the CPU is aimed at the return buffer from the stack

The researchers found another vulnerability associated with attacks on third-party channels of speculative execution of commands, allowing attackers to access confidential data at the level of the CPU.  new Specter category exploits, referred to as SpectreRSB, was delineate well by analysis at the University of Calif. at Riverside in their revealed research paper. Although the vulnerability still affects the process of speculative execution of commands, unlike other options, it is aimed at a new part of the process, called the return buffer from the stack (RSB, Return Stack Buffer).

"In this article, we present a new direction for Specter-like attacks, which is not closed by patches already released, " said security researcher Nael Abu-Ghazaleh in his work. - In particular, attacks use the return buffer from the stack ( RSB ) to cause speculative execution and gain access to confidential information. "

The principle of speculative execution of commands allows attacking an attacker with a local user access level. Since the disclosure of the vulnerabilities of Meltdown and Specter in January, a number of alternatives have been disclosed, but almost all of them were aimed at the branch predictor block or the CPU cache memory.

"RSB can be seen as another branch predictor used for return instructions (while the main predictor is used for branch instructions) ... So, this attack is similar to Spectre, but with a different starting point that has some peculiarities," - the researcher noted.

With the help of malicious code, you can "pollute" the RSB by substituting the required return address and although the CPU then rejects the incorrectly executed instructions, the malicious ones will be able to recover the data of the protected thread from the cache. In this case, as the researchers note, this mechanism is easier than attacking the branch predictor. SpecterRSB also allows you to extract data, including from the protected areas of Intel SGX.

According to the researchers, Intel, AMD, and ARM were informed of the vulnerability - all their modern processors use RSB to predict return addresses. They also added that the new vulnerability is not closed by any of the existing patches or microcode updates and requires additional measures.

However, Intel claims that it is not. "The SpecterRSB attack is related to manipulating the target branch address cache (CVE -2017-5715, branch target injection ), and we expect that the vulnerabilities described in this work will be closed in the same way," the Intel spokesman said. - We have already published a guide for developers in the technical document "Fighting Attacks by Third-Party Channels of Speculative Execution." We are grateful for the ongoing work of the research community, as we work together to protect users. "

In addition to other patches, researchers at UC-Riverside said that there already exists a special protection against SpecterRSB, called "RSB Overflow" - it is currently available for Intel Core i7 chips (starting with the Skylake family). However, this method somewhat slows down the buffer.

Since the publication of the initial information on the three kinds of CPU vulnerabilities associated with speculative calculations (under the common name of Meltdown and Specter), a number of new similar attack options have been disclosed - for example, CVE-2018-3639, bronchoscope, SgxSpectre, MeltdownPrime and SpectrePrime, Specter 1.1 and 1.2. Researchers do not exclude the detection of new types of similar attacks, including those aimed at RSB.

 ONLINE BANGLA SITE / 25 July 2018