Headline
Novel ‘Inception’ Attack Exposes Sensitive Data in CPUs
By Habiba Rashid Dreams of Science Fiction Realized: ETH Researchers Demonstrate “Inception” Attack on CPUs. This is a post from HackRead.com Read the original post: Novel ‘Inception’ Attack Exposes Sensitive Data in CPUs
- ETH Zurich researchers reveal ‘Inception’ attack akin to planting ideas in CPUs.
- Attackers manipulate CPUs’ predictive algorithms to execute specific commands and access sensitive data.
- Vulnerability impacts CPUs by AMD, bypassing security measures and compromising data integrity.
- Researchers notify AMD in advance, allowing development of a patch to mitigate the threat.
- Discovery prompts concerns about broader CPU vulnerabilities and potential impacts on cloud computing.
In a development reminiscent of the mind-bending plot of the movie “Inception,” a team of researchers at ETH Zurich, led by Professor Kaveh Razavi, has successfully demonstrated a novel cybersecurity vulnerability that allows attackers to plant an idea within a computer’s central processing unit (CPU).
This revelation, which has been presented at the USENIX Security 2023 conference, has far-reaching implications for data security and cloud computing.
This discovery shows that certain CPUs can be manipulated into executing specific commands, effectively bypassing security measures and retrieving sensitive information. This novel attack, aptly named the “Inception” attack, revolves around the CPU’s inherent need to make guesses during program execution.
Modern CPUs operate at astounding speeds, making hundreds of millions of decisions per second during program execution. However, data transfer speeds from computer memory (DRAM) to the CPU have struggled to keep pace with this acceleration. To mitigate these delays, CPUs rely on predictive algorithms to anticipate the most likely next steps based on historical data, thereby significantly reducing processing time.
This reliance on predictions creates a vulnerability that attackers can exploit. Similar to the 2018 Spectre attack, where attackers leveraged mispredictions for unauthorized access, the Inception attack involves manipulating the CPU’s look-up table, which stores past instructions and predictions.
In this groundbreaking research shared with Hackread.com, ETH Zurich’s team, led by Professor Razavi, delved into vulnerabilities in CPUs manufactured by AMD. By capitalizing on the CPUs’ inclination to treat erroneous instructions as familiar, the researchers managed to implant an idea into the CPU’s memory during its predictive processes.
Consequently, the protective security features designed to validate the accuracy of predictions were bypassed, enabling the researchers to access sensitive data, including hashed root passwords.
The image provided to Hackread.com shows the devices and hardware used by researchers in the attack. (Photograph: Kaveh Razavi / ETH Zurich)
Professor Razavi’s team alerted AMD to the vulnerability in February, providing the company time to develop a patch before the research was made public. This vulnerability has been assigned the code CVE-2023-20569.
The discovery of the Inception attack poses a significant threat, particularly in the realm of cloud computing, where multiple customers share the same hardware infrastructure. With the potential to compromise data integrity across various virtual environments, cloud providers and hardware manufacturers will need to reconsider their security protocols.
Professor Razavi’s research also raises questions about the broader landscape of CPU vulnerabilities. While this specific attack targeted AMD CPUs, there is a looming concern about the possibility of similar attacks on CPUs from other manufacturers.
RELATED ARTICLES
- ETHERLED Attack Allow Data Exfiltration from Air-gapped PC
- Power LED Extracts Encryption Keys in Groundbreaking Attack
- Stealing data from air-gapped PC by turning RAM into Wi-Fi Card
- Hackers can steal data from air-gapped PC using screen brightness
- Hackers Can Now Steal Data from Air-Gapped PCs via SATA Cables
- Malware can extract data from air-gapped PC through power supply
I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.
Related news
Red Hat Security Advisory 2024-2005-03 - An update for linux-firmware is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Issues addressed include an information leakage vulnerability.
Red Hat Security Advisory 2023-7782-03 - An update for linux-firmware is now available for Red Hat Enterprise Linux 7.6 Advanced Update Support. Issues addressed include an information leakage vulnerability.
An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous state, which impacts the availability of these workloads that may be deployed during this time window. This issue impacts HyperCloud versions from 2.0.0 to before 2.0.3.
Red Hat Security Advisory 2023-7513-01 - An update for linux-firmware is now available for Red Hat Enterprise Linux 7. Issues addressed include an information leakage vulnerability.
Red Hat Security Advisory 2023-7109-01 - An update for linux-firmware is now available for Red Hat Enterprise Linux 8. Issues addressed include an information leakage vulnerability.
Ubuntu Security Notice 6466-1 - Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel contained a race condition during device removal, leading to a use-after- free vulnerability. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code. Hyunwoo Kim discovered that the Technotrend/Hauppauge USB DEC driver in the Linux kernel did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service.
A group of academics has devised a novel side-channel attack dubbed iLeakage that exploits a weakness in the A- and M-series CPUs running on Apple iOS, iPadOS, and macOS devices, enabling the extraction of sensitive information from the Safari web browser. "An attacker can induce Safari to render an arbitrary webpage, subsequently recovering sensitive information present within it using
Ubuntu Security Notice 6445-2 - It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service. Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory.
Ubuntu Security Notice 6445-1 - It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service. Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory.
Ubuntu Security Notice 6416-3 - It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service. Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory.
Ubuntu Security Notice 6416-2 - It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service. Daniël Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory.
Ubuntu Security Notice 6416-1 - It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service. Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory.
Ubuntu Security Notice 6415-1 - Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory. Ivan D Barrera, Christopher Bednarz, Mustafa Ismail, and Shiraz Saleem discovered that the InfiniBand RDMA driver in the Linux kernel did not properly check for zero-length STAG or MR registration. A remote attacker could possibly use this to execute arbitrary code.
Ubuntu Security Notice 6412-1 - Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel contained a race condition during device removal, leading to a use-after- free vulnerability. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code. Hyunwoo Kim discovered that the Technotrend/Hauppauge USB DEC driver in the Linux kernel did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service.
Ubuntu Security Notice 6319-1 - Daniël Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorized memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory.
Debian Linux Security Advisory 5475-1 - Daniel Moghimi discovered Gather Data Sampling (GDS), a hardware vulnerability for Intel CPUs which allows unprivileged speculative access to data which was previously stored in vector registers. This mitigation requires updated CPU microcode provided in the intel-microcode package. Daniel Trujillo, Johannes Wikner and Kaveh Razavi discovered INCEPTION, also known as Speculative Return Stack Overflow (SRSO), a transient execution attack that leaks arbitrary data on all AMD Zen CPUs. An attacker can mis-train the CPU BTB to predict non-architectural CALL instructions in kernel space and use this to control the speculative target of a subsequent kernel RET, potentially leading to information disclosure via a speculative side-channel.
Cybersecurity researchers have disclosed details of a trio of side-channel attacks that could be exploited to leak sensitive data from modern CPUs. Called Collide+Power (CVE-2023-20583), Downfall (CVE-2022-40982), and Inception (CVE-2023-20569), the novel methods follow the disclosure of another newly discovered security vulnerability affecting AMD's Zen 2 architecture-based processors known as
gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client. The unbounded memory buffering bugs: - The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so ...
Microsoft has patched a total of 74 flaws in its software as part of the company's Patch Tuesday updates for August 2023, down from the voluminous 132 vulnerabilities the company fixed last month. This comprises six Critical and 67 Important security vulnerabilities. Also released by the tech giant are two defense-in-depth updates for Microsoft Office (ADV230003) and the Memory Integrity System