July 28, 2018
One more side-channel vulnerability has been found that could be abused in a Spectre-Class attack. This attack method is not stopped by previous patches that tackle the original Spectre flaws. The weakness was identified by scientists at the University of California, Riverside (UCR), which recently published particulars of the attack method which they call Spectre-RSB.
The attack uses the speculative execution characteristic of modern CPUs which increase the working of the CPU by performing computing operations in advance.
In contrast to previous Spectre attacks, this method uses the Return Stack Buffer (RSB) speculation routine rather than the branch predictor unit. RSB is used to predict return addresses in the speculation process with a high level of accuracy. However, the researchers have shown that it is possible to conduct attacks that “exploit the Return Stack Buffer (RSB) to cause speculative execution of the payload gadget that reads and exposes sensitive information.”
The scientists showed that it’s possible to contaminate the RSB and get access to data from other apps on the same CPU and, in one more attack, were able to cause a miss-speculation that disclosed data outside an SGX section.
While the Retpoline and Intel’s microcode patches prevent the original Spectre flaw from being exploited, the researchers say these patches do not address the RSB flaw. Intel has released a patch called RSB refilling for some of its CPUs, which disrupts Spectre-RSB attacks that switch into the kernel. The patch was released to address a separate vulnerability but was only rolled out to Core-i7 Skylake and newer processors, not Intel’s Xeon processor line. The researchers recommended the patch be applied on all machines to protect against Spectre-RSB attacks.
Intel responded to a request from Beeping Computer about the flaws and claimed that the Spectre-RSB attack method is related to the Branch Target Injection vulnerability (CVE-2017-5715) and that existing mitigations can prevent these Spectre-RSB attacks.
The UCR scientists note that although they have not tried the attack technique on AMD and ARM computers, they both use RSB to forecast return addresses and are likely to also be vulnerable to this attack technique.
