CrossLine: Breaking "Security-by-Crash" based Memory Isolation in AMD SEV

CrossLine: Breaking "Security-by-Crash" based Memory Isolation in AMD SEV

연구 분야: Cryptography

학회: CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security

AMD's Secure Encrypted Virtualization (SEV) is an emerging security feature of modern AMD processors that allows virtual machines to run with encrypted memory and perform confidential computing even with an untrusted hypervisor. This paper first demystifies SEV's improper use of address space identifier (ASID) for controlling accesses of a VM to encrypted memory pages, cache lines, and TLB entries. We then present the CROSSLINE attacks, a novel class of attacks against SEV that allow the adversary to launch an attacker VM and change its ASID to that of the victim VM to impersonate the victim. We present two variants of CROSSLINE attacks: CROSSLINE V1 decrypts victim's page tables or any memory blocks conforming to the format of a page table entry; CROSSLINE V2 constructs encryption and decryption oracles by executing instructions of the victim VM. We discuss the applicability of CROSSLINE attacks on AMD's SEV, SEV-ES, and SEV-SNP processors.