Malicious Hypervisor Breaks Confidentiality and Integrity of Confidential VMs by Injecting Interrupts

Core Concepts

A malicious hypervisor can break the confidentiality and integrity of confidential VMs by injecting controlled interrupts that trigger handlers with global effects, allowing the attacker to manipulate the data and control flow of victim applications.

Abstract

The paper presents HECKLER, a new attack that leverages the hypervisor's ability to inject arbitrary interrupts into confidential VMs (CVMs) to break their confidentiality and integrity. The key insight is that certain interrupt handlers in the guest OS can have explicit effects on the application's state, allowing the attacker to change the data and control flow. The authors analyze the interrupt handling mechanisms in AMD SEV-SNP and Intel TDX, and identify several crucial interrupt-based gadgets in prevalent services and workloads typically hosted in cloud-based CVMs. They demonstrate end-to-end exploits that bypass authentication in OpenSSH and sudo, as well as break the integrity of statistical and text analysis applications running on AMD SEV-SNP. The paper also discusses the limitations of existing defenses and outlines guidelines for future defenses against such interrupt-based attacks on confidential computing environments.

Stats

int 0x80 is always delivered to the CVM and impacts the user application on both AMD SEV-SNP and Intel TDX. AMD SEV-SNP allows the attacker to inject 11 other interrupts that are delivered as signals to the user-space application.

Quotes

"HECKLER leverages the untrusted hypervisor's ability to inject controlled interrupts into the victim CVM at points of its choice." "Unlike timer interrupts that are widely used for side-channel attacks because of their effects on cache and micro-architectural states, the CVM has handlers change registers and global state thus impacting the subsequent execution." "By simply injecting interrupts, the hypervisor is able to change the victim VM's data and control flow."

Key Insights Distilled From

Heckler

by Bene... at arxiv.org 04-05-2024

https://arxiv.org/pdf/2404.03387.pdf

Deeper Inquiries

How can the hypervisor precisely time the injection of interrupts to target specific execution points in the victim application

To precisely time the injection of interrupts to target specific execution points in the victim application, the hypervisor can utilize a profiling technique. By creating a function that maps page fault patterns to specific gadgets of interest, the hypervisor can monitor the application's behavior and identify the optimal timing for interrupt injection. This involves an offline phase where the hypervisor learns the mapping function by profiling the application's page accesses and an online phase where the hypervisor observes the application's execution to inject interrupts at the right moment. By analyzing page traces and application-specific page sets, the hypervisor can accurately target the interrupt to the desired core and execution point within the application.

What other types of interrupt-based gadgets could be discovered in a wider range of applications and how could they be chained together for more sophisticated attacks

In a wider range of applications, various types of interrupt-based gadgets could be discovered to facilitate sophisticated attacks. For instance, interrupts that trigger specific signal handlers (e.g., SIGILL, SIGSEGV) could be exploited to induce controlled effects in the application's behavior. By chaining these interrupts strategically, attackers could manipulate the data and control flow of the application to achieve their malicious objectives. Additionally, interrupts that target specific system calls or signal handlers could be identified and combined to create complex attack scenarios. By understanding the application's response to different types of interrupts, attackers can orchestrate a series of interrupt injections to achieve their desired outcomes.

Given the limitations of existing defenses, what novel hardware or software-based mechanisms could be designed to comprehensively protect confidential VMs against such interrupt-based attacks

To comprehensively protect confidential VMs against interrupt-based attacks, novel hardware and software-based mechanisms could be designed. Hardware solutions could involve enhancing the interrupt handling mechanisms within the processor to provide more granular control over interrupt injection and delivery to VMs. This could include features such as interrupt prioritization, secure interrupt routing, and enhanced interrupt validation mechanisms. On the software side, implementing robust intrusion detection and prevention systems specifically designed to detect and mitigate interrupt-based attacks could be beneficial. Additionally, developing runtime monitoring tools that analyze the behavior of applications in real-time to detect anomalous interrupt patterns could help in identifying and preventing such attacks. By combining hardware and software defenses, a multi-layered approach can be established to safeguard confidential VMs against interrupt-based threats.