KU Leuven: Computer scientists expose security vulnerability of Intel processors

Computer scientists from imec-DistriNet (KU Leuven), the University of Birmingham, and TU Graz have shown that the possibility to adjust the operating voltage of Intel processors makes them vulnerable to attack. 

Modern processors are being pushed to perform faster than ever before, and with this come increases in heat and power consumption. That is why many chip manufacturers allow for frequency and voltage to be adjusted as and when needed  – known as ‘undervolting’ or ‘overvolting’ – through what is known as privileged software interfaces.  

Plundervolt attack

In a project called Plundervolt, an international team of researchers examined how these interfaces may be exploited in Intel Core processors to undermine the system’s security. 

The researchers were able to corrupt the integrity of critical computations in so-called SGX "enclaves", which work as a vault for personal data in Intel Core processors (see box below). Intel's state-of-the-art SGX technology was introduced to shield sensitive computations even in the presence of the most advanced types of malware. 

However, the Plundervolt attack now shows that it is possible to introduce persistent errors in enclave computations by carefully adjusting the processor voltage during SGX operation. The researchers exploited these subtle computational errors to reconstruct full cryptographic keys that make it possible to decode application secrets.

Second attack in two years’ time

The SGX enclave technology in Intel processors has already come under attack before. In August 2018, KU Leuven researchers were able to hack the system using the Foreshadow attack. In response to this attack, Intel released patches and updates to resolve the flaw in millions of processors.

However, as Plundervolt makes clear, even the results of supposedly secure enclave computations cannot be trusted, as they may have been corrupted by attackers manipulating the processor's voltage. 

Intel has already responded to this new security threat by supplying a microcode update to mitigate Plundervolt. Users can protect their SGX enclaves by downloading this update. 

What are SGX enclaves?

Computer systems are made up of different layers, making them very complex. Every layer also contains millions of lines of computer code. As this code is still written manually, the risk for errors is significant. If such an error occurs, the entire computer system is left vulnerable to attacks. You can compare it to a skyscraper: if one of the floors is damaged, the entire building might collapse. 

Viruses exploit such errors to gain access to sensitive or personal information on the computer, from holiday pictures and passwords to business secrets. In order to protect their processors against these kinds of intrusions, IT company Intel introduced an innovative technology in 2015: Intel Software Guard eXtensions (Intel SGX). This technology creates isolated environments in the computer's memory, so-called enclaves, where data and programmes can be used securely. 

“If you look at a computer system as a skyscraper, the enclaves form a vault,” explains Jo Van Bulck from the Informatics Section at KU Leuven. “Even when the building collapses, the vault should still guard its secrets.” 

The Intel SGX technology seemed watertight until August 2018, when KU Leuven researchers discovered a breach using the Foreshadow attack. The Plundervolt project has now exposed another vulnerability. Intel has released updates to resolves both flaws. 

Plundervolt was discovered by the following researchers: Kit Murdock, David Oswald, and Flavio Garcia (University of Birmingham); Jo Van Bulck and Frank Piessens (imec-DistriNet, KU Leuven); and Daniel Gruss (TU Graz). Their findings will be presented at the IEEE Symposium on Security & Privacy 2020. 

This research was funded by EPSRC, the European Union’s Horizon 2020 research and innovation programme, VLAIO, and the KU Leuven Research Fund. Jo Van Bulck has a fellowship from FWO (Research Foundation – Flanders). 

The press release issued by the University of Birmingham is available here.