How Does the Foreshadow CPU Attack Work?

TL;DR

Foreshadow exploits a vulnerability deep inside Intel processors by combining transient execution with cache timing to expose protected physical memory. Its effects depend on the targeted security architecture, with demonstrated attack paths involving operating systems, hypervisors, and Intel SGX, and its severity rating of 7.3 exceeded the ratings cited for Spectre, Meltdown, and other speculative execution attacks.

Transcript

Uh, before I start my presentation, I have to tell you how, um, we actually discovered what. So we actually, uh, disclosed this attack to Intel, and then a few, uh, weeks later, there was a second team of, uh, of people of the University of Technion, Michigan, Adelaide, and a company called Data61 who discovered the same, uh, vulnerability. Uh, and... Read More

Key Insights

• Foreshadow is based on one vulnerability inside Intel processors, but its exploitation and consequences vary according to the security architecture being targeted. The presentation distinguishes attacks against an operating system, a hypervisor, and Intel SGX, while noting a less-discussed attack involving system management mode.
• Foreshadow was disclosed after an eight-month responsible disclosure process that allowed mitigations to be put in place. The researchers initially contacted Intel, learned that another team had independently found the same vulnerability, and combined their findings with that team in a single academic paper.
• Foreshadow had a cited severity rating of 7.3, which the presentation describes as higher than the ratings for Spectre, Meltdown, and the other speculative execution attacks discussed. Its processor-level location means that software running above affected processors can potentially be exposed.
• A side-channel attack recovers information by observing indirect physical or computational effects instead of directly opening the protected resource. In Foreshadow, changes in the processor cache carry the secret message, much like sound can reveal the internal response of a mechanical vault.
• The operating-system variant targets physical memory that an attacker-controlled application should not be permitted to read. The kernel is assumed to be benign, while the processor itself is vulnerable and allows out-of-order execution to leave traces of transient instructions in the cache.
• Process isolation is implemented through virtual address spaces and page-table translation. A virtual address is passed through page tables, which either produce a physical address or cause a page fault, while entry bits determine properties such as write access and user or supervisor ownership.
• The page-table present bit records whether an entry currently maps to physical memory. When an operating system moves a virtual page to swap space and clears that bit, Intel documentation permits reuse of the physical-address field to record where the page resides in swap.
• The L1 data cache described in the presentation uses 64-byte cache lines, 64 sets, and eight ways. Cache timing creates a measurable distinction: the cited Skylake system required about 46 cycles for L1 data and about 246 cycles when an access reached main memory.

Questions & Answers

Q: How does the Foreshadow CPU attack work?

Foreshadow combines a processor vulnerability with a cache-based side channel. Out-of-order execution can transiently perform instructions and leave traces in the cache, even when normal protection rules should prevent the requested memory access. An attacker then measures cache behavior to infer protected data. The exact exploitation method and impact depend on whether the target is an operating system, hypervisor, or Intel SGX environment.

Q: What systems can Foreshadow target?

Foreshadow can be exploited differently against several security architectures. The presentation identifies attacks involving operating systems, hypervisors, and Intel SGX. It also mentions an attack against system management mode, although that variant is not discussed because of time constraints. These attacks originate from one processor vulnerability, but their procedures and possible consequences differ because each target protects memory through a different architecture.

Q: Why is Foreshadow classified as a side-channel attack?

Foreshadow is a side-channel attack because it obtains secret information through an indirect signal rather than by directly accessing protected data through an authorized interface. The relevant signal is the processor cache. Transient instructions alter cache state, and the attacker measures access times to determine what was cached. Those timing differences make the cache a carrier through which protected information can be inferred.

Q: How does Foreshadow attack operating-system memory?

The operating-system attack model gives the attacker control of an application running with a benign kernel on a vulnerable processor. The attacker aims to read physical memory that the application is not authorized to access. Foreshadow takes advantage of transient execution traces left in the cache, then uses timing observations to recover information despite the virtual-memory isolation that should separate application and protected physical memory.

Q: How do page tables contribute to the Foreshadow attack?

Page tables translate an application's virtual addresses into physical addresses and enforce properties such as read or write access and user or supervisor ownership. Their entries also contain a present bit and a physical-address field. When the present bit is cleared, documentation allows the address field to be reused, including for recording a page's swap location. The presentation identifies this documented reuse as one component of the attack.

Q: How does cache timing reveal protected information?

Cache timing works because cached and uncached memory accesses take measurably different amounts of time. On the cited Skylake machine, an L1 data-cache access took about 46 cycles, while an access reaching main memory took about 246 cycles. An attacker can load or flush selected data, trigger transient activity, and then time later accesses to identify which cache locations were affected and infer secret information.

Q: What is the role of the L1 data cache in Foreshadow?

The L1 data cache is the cache closest to the CPU in the hierarchy described, followed by L2, L3, and main memory. It stores 64-byte cache lines and is organized into 64 sets with eight ways. Because transient instructions can leave data-dependent traces there, attackers can inspect timing differences across cache locations and use the resulting pattern as an indirect message carrying protected information.

Q: When and how was Foreshadow disclosed?

The researchers disclosed Foreshadow to Intel and later learned that another team from Technion, Michigan, Adelaide, and Data61 had independently reported the same vulnerability. The groups joined their work into one academic paper, while Intel found additional variants. After an eight-month responsible disclosure process intended to allow mitigations to be prepared, Foreshadow was publicly disclosed on August 14, 2018.

Summary & Key Takeaways

• Foreshadow was independently discovered by two research groups, which joined their work into one academic paper after contacting Intel. Intel subsequently identified additional variants. Although Spectre and Meltdown became public on January 3, 2018, Foreshadow remained novel and entered an eight-month responsible disclosure process before its disclosure on August 14.

• The operating-system attack assumes that an attacker controls an application running above a benign kernel on a vulnerable processor. Its objective is to read physical memory that the application should not access. The attack exploits transient instructions that leave observable cache traces, using those traces as a side channel for recovering protected information.

• Virtual memory normally isolates processes by translating virtual addresses through page tables into physical addresses or page faults. Page-table entries include access controls, a present bit, and a physical-address field. When a page is absent, operating systems may reuse that field to record its swap location, a documented behavior that contributes to the attack.