Intel Has No Plans To Patch TLBleed Hyper-Threading CPU Exploit, Here's Why
Intel and its partners have been busy mitigating Spectre and Meltdown, which are two types of speculative side-channel CPU attacks that, if exploited, could potentially expose a user's sensitive data. Most of the mitigations have already been put in place. Other similar vulnerabilities have started to emerge, however, including one that has been dubbed TLBleed. Unlike Spectre and Meltdown though, Intel is not planning on mitigating TLBleed.
Details of the flaw will be presented at the Black Hat USA 2018 conference in early August at Mandalay Bay in Las Vegas. The organization refers to TLBleed as a "novel side-channel attack" that is capable of bypassing several proposed CPU case side-channel protections.
"Our TLBleed exploit successfully leaks a 256-bit EdDSA key from cryptographic signing code, which would be safe from cache attacks with cache isolation turned on, but would no longer be safe with TLBleed. We achieve a 98% success rate after just a single observation of signing operation on a co-resident hyperthread and just 17 seconds of analysis time. Further, we show how another exploit based on TLBleed can leak bits from a side-channel resistant RSA implementation. We use novel machine learning techniques to achieve this level of performance," Black Hat states.
According to The Register, researchers at the Systems and Network Security Group at Vrije Universiteit Amesterdam in the Netherlands say they have been able to leverage TLBleed to expose crypto keys from another running program in 99.8 percent of tests on an Intel Skylake Core i7-6700K processor, 98.2 percent of tests on a Broadwell Xeon E5-2620 vr server chip, and 99.8 percent of tests on a Coffee Lake processor.
So why is Intel standing pat on this one? The technique is not reliant on speculative execution, and because of that it is unrelated to Spectre and Meltdown. What it does instead is build upon the exploitation of Intel's Hyper Threading technology, a known security problem with its own set of mitigations. From Intel's vantage point, existing cache-snooping mitigations are enough to prevent data from leaking from program to another by way of TLBleed.
Here is Intel's full statement on the matter:
Intel has received notice of research from Vrije Universiteit Amsterdam, which outlines a potential side-channel analysis vulnerability referred to as TLBleed. This issue is not reliant on speculative execution, and is therefore unrelated to Spectre or Meltdown. Research on side-channel analysis methods often focuses on manipulating and measuring the characteristics (e.g. timing) of shared hardware resources. These measurements can potentially allow researchers to extract information about the software and related data.TLBleed uses the Translation Lookaside Buffer (TLB), a cache common to many high performance microprocessors that stores recent address translations from virtual memory to physical memory. Software or software libraries such as Intel® Integrated Performance Primitives Cryptography version U3.1 - written to ensure constant execution time and data independent cache traces should be immune to TLBleed. Protecting our customers' data and ensuring the security of our products is a top priority for Intel and we will continue to work with customers, partners and researchers to understand and mitigate any vulnerabilities that are identified.
Not everyone agrees with Intel's stance, however, so we'll have to wait and see how this ultimately plays out.
