SGXDump: Repeatable Code Reuse Attack for Extracting SGX Enclave Memory

SGXDump: A Repeatable Code-Reuse Attack for Extracting SGX Enclave Memory

Contents Background Threat Model SGXDump Attack Overview Attack Design Implementation Conclusion

Background Intel s SGX Enclave ASLR Virtual Address Translation

Intels Software Guard Extensions set of instructions that allows a user process to create a secure area called an enclave inside its address space A hardware-based security solution to provide trusted computing environment.

Enclave ASLR Does NOT randomize the section address inside of the enclave In this study, attacker with root privilege can find the base address of the enclave binary at each execution Thus, All the addresses of the necessary ROP Gadgets can be calculated

Virtual Address Translation Virtual addresses need to be translated into physical addresses OS uses a per-process page table(array of page table entries) to manage its memory at the page level

Virtual Address Translation When an instruction accesses a page, its access page is set to 1 When an attacker has root privilege, this access bit can be used as a covert channel 1. Make a probe array(pa[]), which needs 256 consecutive pages for a page size of 4KB 2. Assume that process acquires 1 byte of secret information s then uses it to access pa[s*4096] - Attacker can obtain s by monitoring pa[] s access bit

Threat Model The primary goal of SGXDump is to extract the memory s entire contents, including any code and data in the target enclave by using the ROP payload assume that the target application running the enclave has a memory corruption vulnerability (e.g., a stack buffer overflow) suppose that the attacker can acquire root privilege, so has complete control of the OS

Threat Model Thus, we assume that the attacker can install a kernel module for checking the access bit of the victim process

SGXDump Attack Overview SGXDump Probe Array Monitor

SGXDump Turns enclave memory values into virtual page numbers in the accessed PTE(Page Table Entry) Reads one byte from enclave memory Binary-shifts the value to the left twelve times Multiplying 4096 to the value Adds base address of the probe array to the value Uses the value as index to access the probe array Sets access bit of PTE to 1

SGXDump The value that SGXDump read from the enclave memory can be recovered based on the index of the accessed probe array To obtain the entire contents, SGXDump iterates until it reaches the end of the memory

Probe Array Monitoring Detect a change in a PTE Recover the value by locating the accessed page number in the PTE Clears the access bit in the PTE and continues To leak data correctly, uses semaphore

Probe Array Monitoring Sync Four-byte memory in target application s stack Uses zero to indicate SGXDump to read next byte Uses starting address of a waiting loop in SGXDump

Attack Design Choosing the Probe Array Conditions of Memory area for Probe Array Mapped Memory area No access by other threads Memory area outside of the Enclave

Attack Design Choosing the Probe Array Finding the satisfying area Analyze memory mapping information of the target process /proc/pid/maps

Attack Design Choosing the Probe Array

Attack Design Choosing the Probe Array Finding the satisfying area Analyze memory mapping information of the target process /proc/pid/maps Check if a thread uses the possible memory area

Attack Design Identifying the Enclave s Base Address Intel s SGX does NOT allow dynamic linking Need a customized ROP payload for each target enclave Only Enclave base address is random in ASLR environment ROP Payload can be constructed correctly with base address

Attack Design SGXDump ROP Payload Structure

Attack Design Synchronization and Data Leak via PAM

Implementation

Implementation Evaluation

Conclusion If memory vulnerability is found on A SGX Application Enclave memory can be leaked easily Presented ROP attack to retrieve the enclave s entire memory Does NOT leave any system logs making the attack more stealthy