Abstract:The ongoing trend of moving data and computation to the cloud is met with concerns regarding privacy and protection of intellectual property. Cloud Service Providers (CSP) must be fully trusted to not tamper with or disclose processed data, hampering adoption of cloud services for many sensitive or critical applications. As a result, CSPs and CPU manufacturers are rushing to find solutions for secure outsourced computation in the Cloud. While enclaves, like Intel SGX, are strongly limited in terms of throughput and size, AMD's Secure Encrypted Virtualization (SEV) offers hardware support for transparently protecting code and data of entire VMs, thus removing the performance, memory and software adaption barriers of enclaves. Through attestation of boot code integrity and means for securely transferring secrets into an encrypted VM, CSPs are effectively removed from the list of trusted entities. There have been several attacks on the security of SEV, by abusing I/O channels to encrypt and decrypt data, or by moving encrypted code blocks at runtime. Yet, none of these attacks have targeted the attestation protocol, the core of the secure computing environment created by SEV. We show that the current attestation mechanism of Zen 1 and Zen 2 architectures has a significant flaw, allowing us to manipulate the loaded code without affecting the attestation outcome. An attacker may abuse this weakness to inject arbitrary code at startup -- and thus take control over the entire VM execution, without any indication to the VM's owner. Our attack primitives allow the attacker to do extensive modifications to the bootloader and the operating system, like injecting spy code or extracting secret data. We present a full end-to-end attack, from the initial exploit to leaking the key of the encrypted disk image during boot, giving the attacker unthrottled access to all of the VM's persistent data.

Cerberus: A Novel Hypervisor to Provide Trusted and Isolated Code Execution

Vcerberus: A DRTM System Based on Virtualization Technology

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

Barrier: a Lightweight Hypervisor for Protecting Kernel Integrity Via Memory Isolation.

Armlock: Hardware-Based Fault Isolation For Arm

Trusted Computing Base Using Virtualization Platform

Cabin: Confining Untrusted Programs within Confidential VMs

The Road to Trust: Building Enclaves within Confidential VMs

A Trustenclave-Based Architecture for Ensuring Run-Time Security in Embedded Terminals

Pcanel/V2: A VMM Architecture Based on Intel VT-x

EqualVisor: Providing Memory Protection in an Untrusted Commodity Hypervisor

undeSErVed trust: Exploiting Permutation-Agnostic Remote Attestation

One-Way Isolation Execution Model Based on Hardware Virtualization

Exploiting Interfaces of Secure Encrypted Virtual Machines

SEVerity: Code Injection Attacks against Encrypted Virtual Machines

SERVAS! Secure Enclaves via RISC-V Authenticryption Shield

SEMMA: Secure Efficient Memory Management Approach in Virtual Environment.

HyperForce: Hypervisor-enForced Execution of Security-Critical Code

SEVered: Subverting AMD's Virtual Machine Encryption

virtCCA: Virtualized Arm Confidential Compute Architecture with TrustZone