Abstract:Interrupts are critical hardware resources for OS kernels to schedule processes. As they are related to system activities, interrupts can be used to mount various side-channel attacks (i.e., monitoring keystrokes, inferring website visits, detecting GPU activities, and fingerprinting processes). Given that all these attacks rely on system file interfaces or architectural timers to probe interrupts, various countermeasures have been proposed to either remove the unprivileged access to the file interfaces or detect/cripple architectural timers. In this work, we propose SegScope, a new technique that abuses segment protection to provision fine-grained interrupt observations without any timer. As segment protection is widely used on x86, SegScope works across a wide range of Intel- and AMD-based CPUs. Particularly, we observe that while segment protection preserves the confidentiality of high privileged domain, it leaves a footprint via the data segment registers values when an interrupt occurs. With this key observation, SegScope is crafted by capturing the footprints. To show its security implications, we evaluate it in four case studies. First, SegScope has inferred website visits with a respective success rate of 92.4% on Chrome and 87.4% on Tor Browser in default system settings. Second, SegScope successfully extracts the keys from Cloudflare's Interoperable Reusable Cryptographic Library (CIRCL) v1.1. Third, SegScope steals DNN model architectures with an accuracy of over 80%. Last, SegScope effectively reduces the noise of interrupts to improve the performance of other side channels. As an example, SegScope reduces the error rate of Spectral side channel by 56x. Compared with existing timer-based interrupt-probing techniques, SegScope is fine-grained without introducing false-positives. Further, we leverage SegScope to craft a fine-grained timer, as regular timer interrupts as clock edges contain timestamps. Our evaluation shows that it achieves the same level of timing granularity as the high-resolution timer, i.e., rdtsc and rdpru. We then leverage the timer to break KASLR in about 10 seconds and mount a Flush+Reload based Spectre attack.

DegradeTimer: Mitigating Dedicated Thread Timer Based Microarchitectural Timing Channels

Heterogeneous Static Timing Analysis with Advanced Delay Calculator

Timing Cache Accesses to Eliminate Side Channels in Shared Software

DDM: A Demand-based Dynamic Mitigation for SMT Transient Channels

Eliminating Timing Errors Through Collaborative Design to Maximize the Throughput

Timing Side-Channel Attacks and Countermeasures in CPU Microarchitectures

ClepsydraCache -- Preventing Cache Attacks with Time-Based Evictions

MCU-Wide Timing Side Channels and Their Detection

SegScope: Probing Fine-grained Interrupts Via Architectural Footprints

TC-Release++: an Efficient Timestamp-Based Coherence Protocol for Many-Core Architectures.

MIPE: a Practical Memory Integrity Protection Method in a Trusted Execution Environment.

Ozone: Efficient Execution with Zero Timing Leakage for Modern Microarchitectures

DATE: Defense Against TEmperature Side-Channel Attacks in DVFS Enabled MPSoCs

De-randomizing the Code Segment with Timing Function Attack

SwiftDir: Secure Cache Coherence Without Overprotection.

SpectreRewind: Leaking Secrets to Past Instructions

Time Protection: the Missing OS Abstraction

Amplifying Main Memory-Based Timing Covert and Side Channels using Processing-in-Memory Operations

Prevention of Microarchitectural Covert Channels on an Open-Source 64-bit RISC-V Core

fence.t.s: Closing Timing Channels in High-Performance Out-of-Order Cores through ISA-Supported Temporal Partitioning

IChannels: Exploiting Current Management Mechanisms to Create Covert Channels in Modern Processors