Presentation
PMU-Faker: The Apparently Harmless Performance Monitoring Unit Events Are Actually Harmful
DescriptionPrevious studies have verified that some special Performance Monitoring Unit (PMU) events are insecure. In this work, we further disclose that even the PMU events are securely designed and implemented, they are capable of constructing malicious attacks.
We develop and implement a fuzz testing framework to automatically identify and verify numerous PMU events. Based on which, we successfully discover 118 vulnerable PMU events. Leveraging these identified events, we introduce PMU-Faker, a precise timing mechanism that can implement most of the timing-based side channel attacks without timer. To accommodate variations in instruction-triggered cycle durations, PMU-Faker provides two timing mechanisms with varying levels of granularity, thereby balancing precision and adaptability. Moreover, we successfully utilizing PMU-Faker to implement four attacks including executing transient execution attacks, extracting AES's key, conducting attacks against Intel Software Guard Extensions (SGX), and achieving cross-virtual machine information leakage.
We develop and implement a fuzz testing framework to automatically identify and verify numerous PMU events. Based on which, we successfully discover 118 vulnerable PMU events. Leveraging these identified events, we introduce PMU-Faker, a precise timing mechanism that can implement most of the timing-based side channel attacks without timer. To accommodate variations in instruction-triggered cycle durations, PMU-Faker provides two timing mechanisms with varying levels of granularity, thereby balancing precision and adaptability. Moreover, we successfully utilizing PMU-Faker to implement four attacks including executing transient execution attacks, extracting AES's key, conducting attacks against Intel Software Guard Extensions (SGX), and achieving cross-virtual machine information leakage.
Event Type
Research Manuscript
TimeTuesday, July 284:42pm - 4:54pm PDT
LocationMtg Room 203C
Similar Presentations