Abstract:Many modern processors have embedded hardware tracing techniques (e.g., Intel Processor Trace or ARM CoreSight). While these techniques are widely used due to their transparency and low overhead, they also bring serious security threats. Attackers can utilize hardware tracing to trace the trusted applications from a non-secure application. Existing protection techniques fail to effectively protect the runtime information when hardware tracing is employed. To counter these threats, in this paper, we propose a novel direction called anti-hardware tracing. Our key idea is to exploit the limitations of hardware tracing: trace buffer overflow can cause trace data loss. We build a model to analyse the overflow and outline three principles for efficient triggering overflows and achieving anti-hardware tracing: numerous branches in the program, high-speed execution of the program, and the high-water mark of the trace buffer. We develop a framework called Armor on ARM Juno R2 to realize our approach. Armor protects software against the trace unit Embedded Trace Macrocell (ETM) in CoreSight by instrumenting protection and loop functions. The protection function detects runtime environments, efficiently fills the trace buffer, and employs various protection strategies like PID (process identifier) replacement and PIE+STRIP+ASLR. Meanwhile, the loop function triggers overflows efficiently based on context-based calculations and anti-ETM loop. Our evaluation demonstrates that the overhead of Armor is 77.31% lower than that of OLLVM [1] on SPEC2006. Armor effectively hides 54.51% of basic blocks across 16 real-world applications, triggering 113× more overflows. Moreover, we showcase two practical applications of Armor. Firstly, we conduct a cryptographic and cross-world attack on GnuPG 1.4.13 RSA private keys using ETM, which can steal entire keys from a program in the Secure world with a single run. Armor successfully reduces leaked bits by 84.5%. Secondly, Armor impedes hardware-assisted fuzzing by reducing throughput by 89.71% and branch coverage by 47.99%.

VeriFence: Lightweight and Precise Spectre Defenses for Untrusted Linux Kernel Extensions

Simple and precise static analysis of untrusted Linux kernel extensions

SafeBPF: Hardware-assisted Defense-in-depth for eBPF Kernel Extensions

Armlock: Hardware-Based Fault Isolation For Arm

Unleashing Unprivileged eBPF Potential with Dynamic Sandboxing

MOAT: Towards Safe BPF Kernel Extension

Software Mitigation of RISC-V Spectre Attacks

SoK: Practical Foundations for Software Spectre Defenses

A Scheduling-Aware Defense Against Prefetching-Based Side-Channel Attacks

Beyond Over-Protection: A Targeted Approach to Spectre Mitigation and Performance Optimization

BRF: eBPF Runtime Fuzzer

Barrier: a Lightweight Hypervisor for Protecting Kernel Integrity Via Memory Isolation.

Comprehensive Kernel Safety in the Spectre Era: Mitigations and Performance Evaluation (Extended Version)

Armor: Protecting Software Against Hardware Tracing Techniques

SMoTherSpectre: exploiting speculative execution through port contention

iKern: Advanced Intrusion Detection and Prevention at the Kernel Level Using eBPF

iperfTZ: Understanding Network Bottlenecks for TrustZone-based Trusted Applications

The eBPF Runtime in the Linux Kernel

Libra: Architectural Support For Principled, Secure And Efficient Balanced Execution On High-End Processors (Extended Version)

Programmable System Call Security with eBPF

IOTLB-SC: An Accelerator-Independent Leakage Source in Modern Cloud Systems