SegScope: Probing Fine-grained Interrupts via Architectural Footprints

Xin Zhang, Zhi Zhang, Qingni Shen, Wenhao Wang, Yansong Gao, Zhuoxi Yang, Jiliang Zhang

Abstract:

Interrupts are critical hardware resources for OS kernels to schedule processes. As they are related to system activities, interrupts can be used to mount various side-channel attacks (i.e., monitoring keystrokes, inferring website visits, detecting GPU activities, and fingerprinting
processes). Given that all these attacks rely on system file interfaces or architectural timers to probe interrupts, various countermeasures have been proposed to either remove the unprivileged access to the file interfaces or detect/cripple architectural timers.

In this work, we propose \name, a new technique that abuses \mechanism to provision \emph{fine-grained} interrupt observations \emph{without any timer}. As \mechanism is widely used on x86, \name works across a wide range of Intel- and AMD-based CPUs. Particularly, we observe that while \mechanism preserves the confidentiality of high privileged domain, it leaves a footprint via the data segment registers values when an interrupt occurs. With this key observation, \name is crafted by capturing the footprints.
To show its security implications, we evaluate it in four case studies. \emph{First}, \name has inferred website visits with a respective success rate of 92.4\% on Chrome and 87.4\% on Tor Browser in default
system settings. \emph{Second}, \name successfully extracts the keys from Cloudflare’s Interoperable Reusable Cryptographic Library (CIRCL) v1.1. \emph{Third}, \name steals DNN model architectures with an accuracy of over 80\%. Last, \name effectively reduces the
noise of interrupts to improve the performance of other side channels. As an example, \name reduces the error rate of Spectral side channel by $56\times$. Compared with existing timer-based interrupt-probing techniques, \name is fine-grained without introducing false-positives.
Further, we leverage \name to craft a fine-grained timer, as regular timer interrupts as clock edges contain timestamps.
Our evaluation shows that it achieves the same level of timing granularity as the high-resolution timer, i.e., \texttt{rdtsc} and \texttt{rdpru}.
We then leverage the timer to break KASLR in about 10 seconds and mount a Flush+Reload based Spectre attack.