Awesome
AEPIC Leak
This is the PoC implementation for the USENIX 2022 paper AEPIC Leak: Architecturally Leaking Uninitialized Data from the Microarchitecture by Pietro Borrello, Andreas Kogler, Martin Schwarzl, Moritz Lipp, Daniel Gruss, and Michael Schwarz.
AEPIC Leak is the first architectural CPU bug that leaks stale data from the microarchitecture without using a side channel. It architecturally leaks stale data incorrectly returned by reading undefined APIC-register ranges.
This README provides instruction on how to build and run the described attack. The total install time should be around 30 minutes.
0. Jumpstart: Run APIC Dump
We provide a simple kernel module that dumps the content of the APIC MMIO region. This confirms that the APIC leaks data on the machine tested.
$ cd src/apic_dump
$ make run
If your CPU is vulnerable, running the apic_dump
you will observe spurious memory returned by the APIC, as opposed to 0x00
bytes.
NOTE:
Make sure that the machine is booted in xAPIC mode, by providing nox2apic
in the Linux kernel command line.
1. Dependencies
sudo apt install -y g++-11
build sgx-step SDK and library
git submodule init
cd sgx-step
cd sdk/intel-sdk/ && ./install_SGX_SDK.sh && source /opt/intel/sgxsdk/environment
cd libsgxstep && make && cd ..
2. Build
This step builds the Custom SGX Driver and the attack PoCs.
$ cd src
$ make
3. Load the Custom SGX Driver
$ cd src
$ make load
4. Run the experiments
Victim Enclaves
Victim runner to experiment:
- aes: to leak Intel IPPC AES
- egetkey: to leak seal key
- memory: to leak simple memory content
- rdrand: to leak rdrand content
- rsa: to leak rsa private key
- simple_ssa: to leak SSA region
Enclave Runner
Runs a victim enclave and waits for user input to terminate it:
cd src/runner
./runner ../enclaves/aes/enclave.signed.so
Enclave Dumper
Dumps the whole memory of an enclave by exploiting AEPIC Leak.
Usage: ./dumper [enclave_pid] [enclave_idx] [flags] [dump_file]
where flags: x=dump_code d=dump_data p=non_present s=show r=readable
E.g.,
./dumper `pidof runner` 0 dsr <output_file>
Enclave Stepper
Single steps an enclave until the required instruction, and then dumps the target registers by dumping the SSA page using AEPIC Leak.
sudo ./stepper <path_to_enclave> <print_readable> <path_to_config>
We use a configuration file to tell the stepper when to stop and what to dump. E.g. src/enclaves/aes/stepper_config
.