LAS VEGAS—A new chip-level vulnerability that affects all current Intel processors, dubbed SwapGS, gives attackers "a method to access all information in the operating system kernel memory," security giant Bitdefender revealed here at Black Hat. That's serious. No process should have that level of access to memory.
This discovery comes after Meltdown broke hardware-enforced security boundaries by exploiting technologies used to make CPU process instructions faster. Microsoft issued Windows patches to prevent malicious activity that exploited that vulnerability, but since the problem was at the chip level, full protection required action by Intel. Another flaw in CPU chips known as Spectre used similar techniques to gain access to data that should be totally secure.
Speculative Execution
All of these attacks make use of a technology called speculative execution. Effectively, the CPU guesses that execution is going to proceed down one of two branches, so it executes that branch in a kind of trial mode. If in fact the other branch is appropriate, it discards the traces of the trial. A tech running the program in a debugger can't see the speculative execution, but leaves traces in CPU caches.
When this technology works, it speeds the CPU's processing, but its implementation has led to these security problems.
"Criminals with knowledge of these attacks would have the power to uncover the most vital, best protected information of both companies and private individuals around the world, and the corresponding power to steal, blackmail, sabotage, and spy," said Gavin Hill, VP of Datacenter and Network Security Products at Bitdefender.
Bitdefender's Discovery
Bitdefender researchers Andrei Lutas and Dan Lutas (no relation) demurred when I asked their titles, preferring to be just called "researchers." However, their colleagues suggested "CPU Ninja" or "Research Genius" might be appropriate. Indeed, much of their detailed explanation of the SwapGS vulnerability went over my head. I'll try to lay it out in layman's terms.
The SwapGS command in effect swaps a pointer from no-worries user-mode memory so it instead points to super-secure kernel memory. That's fine when it works as designed, but a trick involving speculative execution can force it to happen when it shouldn't. And these two researchers found a clear way to make it happen. They also detailed the dead ends and alternate attempts along the way.
After identifying the possibility to force access to kernel-mode memory, they searched the Windows OS for instances of code that could be vulnerable, and found 38. "Of course, you only need one," said Andrei Lutas. "And since these instances involve exception handlers, an attacker can force execution just by triggering an exception."
Not All Bad News
There is some good news. The full-on attack to obtain specific secrets from kernel memory would take hours, according to their calculations. And even with complete success, only about a third of kernel memory can possibly be compromised.
Bitdefender has worked with Intel for more than a year on public disclosure of SwapGS. It's possible that an attacker with knowledge of the vulnerability could have exploited it to steal confidential information. On the bright side, Microsoft has issued a patch for Windows, and the researchers couldn't find a way to turn the attack on Linux.
Are you and your own devices in danger from SwapGS? We don't know for sure yet. Bitdefender's team believes at present that, unlike Spectre, this flaw does not affect Apple devices, but they're waiting on confirmation from Cupertino. They also expect that any use of the flaw would be "extremely targeted attacks against a narrow set of threat actors." This suggests that unless you're a CEO, head of state, or some other prominent target, you're probably safe.
In addition, if you keep your Windows installation fully patched, you should have nothing to worry about. Businesses and enterprises that, for their own reasons, delay patching have another alternative in Bitdefender's esoteric Hypervisor Introspection tool, which can effectively patch the operating system on the fly.
If you're one of those rare individuals with a deep understanding of how modern CPUs work, you can check out the details of the detailed SwapGS whitepaper released today by Bitdefender.