Paper Info
Title
Plundervolt: Software-based Fault Injection Attacks against Intel SGX
Abstract
Dynamic frequency and voltage scaling features have been introduced to manage ever-growing heat and power consumption in modern processors. Design restrictions ensure frequency and voltage are adjusted as a pair, based on the current load, because for each frequency there is only a certain voltage range where the processor can operate correctly. For this purpose, many processors (including the widespread Intel Core series) expose privileged software interfaces to dynamically regulate processor frequency and operating voltage.In this paper, we demonstrate that these privileged interfaces can be reliably exploited to undermine the system's security. We present the Plundervolt attack, in which a privileged software adversary abuses an undocumented Intel Core voltage scaling interface to corrupt the integrity of Intel SGX enclave computations. Plundervolt carefully controls the processor's supply voltage during an enclave computation, inducing predictable faults within the processor package. Consequently, even Intel SGX's memory encryption/authentication technology cannot protect against Plundervolt. In multiple case studies, we show how the induced faults in enclave computations can be leveraged in real-world attacks to recover keys from cryptographic algorithms (including the AES-NI instruction set extension) or to induce memory safety vulnerabilities into bug-free enclave code. We finally discuss why mitigating Plundervolt is not trivial, requiring trusted computing base recovery through microcode updates or hardware changes.
Year
DOI
Venue
2020
10.1109/SP40000.2020.00057
2020 IEEE Symposium on Security and Privacy (SP)
Keywords
DocType
ISSN
software-based fault injection attacks,dynamic frequency,voltage scaling features,power consumption,design restrictions,current load,privileged software interfaces,processor frequency,operating voltage,privileged interfaces,Plundervolt attack,privileged software adversary abuses,Intel SGX enclave computations,supply voltage,enclave computation,predictable faults,processor package,induced faults,real-world attacks,bug-free enclave code,trusted computing base recovery,Plundervolt,Intel Core series,Intel Core voltage scaling interface
Conference
1081-6011
ISBN
Citations 
PageRank 
978-1-7281-3498-7
11
0.58
References 
Authors
16
6
Name
Order
Citations
PageRank
Kit Murdock1110.58
David Oswald224020.38
Flavio D. Garcia343833.08
Jo Van Bulck412810.30
daniel gruss559034.22
Frank Piessens62455162.28