Skip to main content
Commonmark migration
Source Link

Title:

Reverse Engineering x86 Processor Microcode

Abstract: Microcode is an abstraction layer on top of the physical components of a CPU and present in most generalpurpose CPUs today. In addition to facilitate complex and vast instruction sets, it also provides an update mechanism that allows CPUs to be patched in-place without requiring any special hardware. While it is well-known that CPUs are regularly updated with this mechanism, very little is known about its inner workings given that microcode and the update mechanism are proprietary and have not been throughly analyzed yet. In this paper, we reverse engineer the microcode semantics and inner workings of its update mechanism of conventional COTS CPUs on the example of AMD’s K8 and K10 microarchitectures. Furthermore, we demonstrate how to develop custom microcode updates. We describe the microcode semantics and additionally present a set of microprograms that demonstrate the possibilities offered by this technology. To this end, our microprograms range from CPU-assisted instrumentation to microcoded Trojans that can even be reached from within a web browser and enable remote code execution and cryptographic implementation attacks.

Author: Philipp Koppe, Benjamin Kollenda, Marc Fyrbiak, Christian Kison, Robert Gawlik, Christof Paar, and Thorsten Holz

http://syssec.rub.de/media/emma/veroeffentlichungen/2017/08/16/usenix17-microcode.pdf

Related Work/Reads:

 

Title:

Meltdown and Spectre: Bugs in modern computers leak passwords and sensitive data

TLDR:

Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

Paper:

https://meltdownattack.com/meltdown.pdf

https://spectreattack.com/spectre.pdf

Related Resources:

Title:

Reverse Engineering x86 Processor Microcode

Abstract: Microcode is an abstraction layer on top of the physical components of a CPU and present in most generalpurpose CPUs today. In addition to facilitate complex and vast instruction sets, it also provides an update mechanism that allows CPUs to be patched in-place without requiring any special hardware. While it is well-known that CPUs are regularly updated with this mechanism, very little is known about its inner workings given that microcode and the update mechanism are proprietary and have not been throughly analyzed yet. In this paper, we reverse engineer the microcode semantics and inner workings of its update mechanism of conventional COTS CPUs on the example of AMD’s K8 and K10 microarchitectures. Furthermore, we demonstrate how to develop custom microcode updates. We describe the microcode semantics and additionally present a set of microprograms that demonstrate the possibilities offered by this technology. To this end, our microprograms range from CPU-assisted instrumentation to microcoded Trojans that can even be reached from within a web browser and enable remote code execution and cryptographic implementation attacks.

Author: Philipp Koppe, Benjamin Kollenda, Marc Fyrbiak, Christian Kison, Robert Gawlik, Christof Paar, and Thorsten Holz

http://syssec.rub.de/media/emma/veroeffentlichungen/2017/08/16/usenix17-microcode.pdf

Related Work/Reads:

 

Title:

Meltdown and Spectre: Bugs in modern computers leak passwords and sensitive data

TLDR:

Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

Paper:

https://meltdownattack.com/meltdown.pdf

https://spectreattack.com/spectre.pdf

Related Resources:

Title:

Reverse Engineering x86 Processor Microcode

Abstract: Microcode is an abstraction layer on top of the physical components of a CPU and present in most generalpurpose CPUs today. In addition to facilitate complex and vast instruction sets, it also provides an update mechanism that allows CPUs to be patched in-place without requiring any special hardware. While it is well-known that CPUs are regularly updated with this mechanism, very little is known about its inner workings given that microcode and the update mechanism are proprietary and have not been throughly analyzed yet. In this paper, we reverse engineer the microcode semantics and inner workings of its update mechanism of conventional COTS CPUs on the example of AMD’s K8 and K10 microarchitectures. Furthermore, we demonstrate how to develop custom microcode updates. We describe the microcode semantics and additionally present a set of microprograms that demonstrate the possibilities offered by this technology. To this end, our microprograms range from CPU-assisted instrumentation to microcoded Trojans that can even be reached from within a web browser and enable remote code execution and cryptographic implementation attacks.

Author: Philipp Koppe, Benjamin Kollenda, Marc Fyrbiak, Christian Kison, Robert Gawlik, Christof Paar, and Thorsten Holz

http://syssec.rub.de/media/emma/veroeffentlichungen/2017/08/16/usenix17-microcode.pdf

Related Work/Reads:

Title:

Meltdown and Spectre: Bugs in modern computers leak passwords and sensitive data

TLDR:

Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

Paper:

https://meltdownattack.com/meltdown.pdf

https://spectreattack.com/spectre.pdf

Related Resources:

I added the two papers as reference and moved the project zero post to related resources.
Source Link
knx
  • 1.3k
  • 1
  • 10
  • 26

EDIT: InI added the recently published spectre or meltdown attack, which exploits critical vulnerabilities in modern processors.

Title:

Project ZeroMeltdown and Spectre: Reading privileged memory with a side-channelBugs in modern computers leak passwords and sensitive data

TLDR:

We have discovered that CPUMeltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data cache timing can be abusedwhich is currently processed on the computer. While programs are typically not permitted to efficiently leak information out of mis-speculated executionread data from other programs, leadinga malicious program can exploit Meltdown and Spectre to (at worst) arbitrary virtualget hold of secrets stored in the memory read vulnerabilities across local security boundariesof other running programs. This might include your passwords stored in various contextsa password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

AuthorPaper: Jann Horn

Source:https://meltdownattack.com/meltdown.pdf

https://googleprojectzero.blogspot.de/2018/01/reading-privileged-memory-with-side.html?m=1https://spectreattack.com/spectre.pdf

Related Resources:

EDIT: In added the recently published spectre or meltdown attack, which exploits critical vulnerabilities in modern processors.

Title:

Project Zero: Reading privileged memory with a side-channel

TLDR:

We have discovered that CPU data cache timing can be abused to efficiently leak information out of mis-speculated execution, leading to (at worst) arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts.

Author: Jann Horn

Source:

https://googleprojectzero.blogspot.de/2018/01/reading-privileged-memory-with-side.html?m=1

Related Resources:

EDIT: I added the recently published spectre or meltdown attack, which exploits critical vulnerabilities in modern processors.

Title:

Meltdown and Spectre: Bugs in modern computers leak passwords and sensitive data

TLDR:

Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

Paper:

https://meltdownattack.com/meltdown.pdf

https://spectreattack.com/spectre.pdf

Related Resources:

deleted 467 characters in body
Source Link
knx
  • 1.3k
  • 1
  • 10
  • 26

EDIT: In addition, even some of the sources are somewhat nebulous and speculative, I addadded the currently discussed Intel-CPU patchesrecently published (Jan-2018)spectre or meltdown attack, which exploits critical vulnerabilities in modern processors.

Title:

The mysterious case of the Linux Page Table Isolation patchesProject Zero: Reading privileged memory with a side-channel

TLDR:

There is presently an embargoed security bug impacting apparently all contemporary CPU architecturesWe have discovered that implement virtual memory, requiring hardware changesCPU data cache timing can be abused to fully resolve. Urgent developmentefficiently leak information out of a software mitigation is being done in the open and recently landed in the Linux kernelmis-speculated execution, and a similar mitigation began appearing in NT kernels in November. In theleading to (at worst case the software fix causes huge slowdowns) arbitrary virtual memory read vulnerabilities across local security boundaries in typical workloads. There are hints the attack impacts common virtualization environments including Amazon EC2 and Google Compute Engine, and additional hints the exact attack may involve a new variant of Rowhammervarious contexts.

Author: Jann Horn

Source:

http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-tablehttps://googleprojectzero.blogspot.de/2018/01/reading-privileged-memory-with-side.html?m=1

You should additionally check some of the "errata".Related Resources:

Related Resources:

EDIT: In addition, even some of the sources are somewhat nebulous and speculative, I add the currently discussed Intel-CPU patches (Jan-2018).

Title:

The mysterious case of the Linux Page Table Isolation patches

TLDR:

There is presently an embargoed security bug impacting apparently all contemporary CPU architectures that implement virtual memory, requiring hardware changes to fully resolve. Urgent development of a software mitigation is being done in the open and recently landed in the Linux kernel, and a similar mitigation began appearing in NT kernels in November. In the worst case the software fix causes huge slowdowns in typical workloads. There are hints the attack impacts common virtualization environments including Amazon EC2 and Google Compute Engine, and additional hints the exact attack may involve a new variant of Rowhammer.

Source:

http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table

You should additionally check some of the "errata".

Related Resources:

EDIT: In added the recently published spectre or meltdown attack, which exploits critical vulnerabilities in modern processors.

Title:

Project Zero: Reading privileged memory with a side-channel

TLDR:

We have discovered that CPU data cache timing can be abused to efficiently leak information out of mis-speculated execution, leading to (at worst) arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts.

Author: Jann Horn

Source:

https://googleprojectzero.blogspot.de/2018/01/reading-privileged-memory-with-side.html?m=1

Related Resources:

Added an additional source to the answer.
Source Link
knx
  • 1.3k
  • 1
  • 10
  • 26
Loading
updated resources
Source Link
knx
  • 1.3k
  • 1
  • 10
  • 26
Loading
added 1001 characters in body
Source Link
knx
  • 1.3k
  • 1
  • 10
  • 26
Loading
added one reference
Source Link
knx
  • 1.3k
  • 1
  • 10
  • 26
Loading
Source Link
knx
  • 1.3k
  • 1
  • 10
  • 26
Loading