Downfall Attack Enables Extraction of Passwords and Encryption Key From Intel Microprocessor

Gather Data Sampling (GDS) impacts select Intel CPUs, enabling attackers to deduce outdated data through malicious use of gather instructions. While all these entries link to the prior thread or sibling core registers.

Like MDS, GDS (Gather Data Sampling) enables local code execution to reveal protected secret data. GDS is different from MDS as it exposes only stale vector register data through specific gathering instructions, lacking user choice in suspected data.

Cybersecurity researcher Daniel Moghimi at Google recently crafted a ‘Downfall’ CPU attack that enables threat actors to extract the following data from Intel chips shared by users:- 

• Passwords
• Keys
• Emails
• Banking

Cybersecurity researchers tracked this vulnerability as CVE-2022-40982, and this flaw affects the Skylake to Ice Lake chips from Intel with transient execution side-channel issues.

Flaw profile

• CVE ID: CVE-2022-40982
• Description: Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to enable information disclosure via local access potentially.
• CVSS Base Score: 6.5
• Severity: MEDIUM
• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Technical analysis

By exploiting this vulnerability, a threat actor can easily retrieve the protected sensitive data through Intel’s SGX, which segregates the code and memory.

Besides this, the SGX exclusively aids the server CPUs which enables it to establish a secure enclave that is inaccessible even by the OS itself.

Moreover, Daniel Moghimi revealed the exploitative nature of Downfall, under which this flaw exploits the gathered instructions for a speculative leak of vector register content.

Moghimi seized AES keys through GDS across VMs, even from cores’ sibling threads. In under 10s, 8 bytes at a time, the researcher fused stolen AES round keys to crack encryption.

However, apart from this, the researcher leveraged the undisclosed techniques in this scenario on powerful CPUs to breach data barriers between:-

• User-kernel
• Processes
• VMs
• Secure execution domains

Failed tries prompted repeated attacks, as the master key data was infrequent within 10 seconds. Moghimi offers diverse GDS attacks, snatching varied data due to specific SIMD buffer conditions.

Affected CPU families

Downfall needs attacker presence on the victim’s physical core, facilitated by current shared computing.

Local malware might exploit it, and besides this, Intel already acknowledged the flaw with Moghimi in August, issuing a microcode fix.

Vulnerability remained undisclosed for nearly a year, allowing OEMs and CSPs to validate fixes.

But, Intel affirms that Alder Lake, Raptor Lake, and Sapphire Rapids series were not affected, as the Downfall affects the following CPU families:-

• Skylake
• Cascade Lake
• Cooper Lake
• Amber Lake
• Kaby Lake
• Coffee Lake
• Whiskey Lake
• Comet Lake
• Tiger Lake family
• Ice Lake
• Rocket Lake

In this case, to leak data, Daniel Moghimi exploited the REDACTED on high-performance REDACTED CPUs by breaching the user-kernel boundaries across systems.

Recommendations

Here below, we have mentioned all the recommendations from Intel:-

• For enhanced security, Intel advises users of affected processors to install the latest firmware from their system manufacturer.
• Intel suggests SGX users update platform flash microcode via firmware interface table.
• Intel’s new microcode update prevents the attackers from observing gather instruction results.
• To counter this flaw, an SGX TCB recovery is in the works.
• Non-Intel (SGX) systems can apply microcode fixes via OS loading.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.