论文标题
Ghost Knight：通过投机执行违反数据完整性
GhostKnight: Breaching Data Integrity via Speculative Execution
论文作者
论文摘要
现有的投机执行攻击仅限于违反超出特权边界的数据的机密性，即所谓的Spectre-type攻击。他们所有人都利用了投机执行所做的微体系间缓冲区的更改来泄漏数据。我们表明，可以滥用投机性执行以打破数据完整性。我们观察到，投机性执行不仅在微体系缓冲区中留下痕迹，而且还会在DRAM内引起副作用，也就是说，投机执行可以触发DRAM中对非法地址的访问。如果对DRAM的访问足够频繁，则会发生架构更改（即，DRAM中的永久位翻转），我们将其称为Ghost Knight。凭借Ghost Knight的力量，攻击者基本上能够跨越不同的特权边界，并将可剥削的位写入其他特权域。在未来的工作中，我们将开发基于Ghost Knight的利用，以跨越可信赖的执行环境，击败1024位RSA指示实现并获得可控制的签名。
Existing speculative execution attacks are limited to breaching confidentiality of data beyond privilege boundary, the so-called spectre-type attacks. All of them utilize the changes in microarchitectural buffers made by the speculative execution to leak data. We show that the speculative execution can be abused to break data integrity. We observe that the speculative execution not only leaves traces in the microarchitectural buffers but also induces side effects within DRAM, that is, the speculative execution can trigger an access to an illegitimate address in DRAM. If the access to DRAM is frequent enough, then architectural changes (i.e., permanent bit flips in DRAM) will occur, which we term GhostKnight. With the power of of GhostKnight, an attacker is essentially able to cross different privilege boundaries and write exploitable bits to other privilege domains. In our future work, we will develop a GhostKnight-based exploit to cross a trusted execution environment, defeat a 1024-bit RSA exponentiation implementation and obtain a controllable signature.
