论文标题
跨线：在AMD SEV中打破基于“安全性”的内存隔离
CROSSLINE: Breaking "Security-by-Crash" based Memory Isolation in AMD SEV
论文作者
论文摘要
AMD的安全加密虚拟化（SEV）是AMD处理器上的新兴安全功能，即使使用不受信任的操纵虚拟机构，虚拟机可以在加密内存上运行并执行机密计算。本文首先揭示了SEV对地址空间标识符（ASID）的不当使用，以控制VM对加密内存页面，缓存线和TLB条目的访问。然后，我们提出了跨线攻击，这是针对SEV的一类新颖的攻击，使对手能够发射攻击者VM并将其ASID更改为受害者VM的ASID，以模仿受害者。我们提出了跨线攻击的两个变体：跨线V1解密受害者的页面表或记忆块，遵循页面表条目的格式；跨线V2通过执行受害者VM的说明来构建加密和解密。我们已经成功地对SEV和SEV-ES处理器进行了跨线攻击。
AMD's Secure Encrypted Virtualization (SEV) is an emerging security feature on AMD processors that allows virtual machines to run on encrypted memory and perform confidential computing even with an untrusted hypervisor. This paper first demystifies SEV's improper use of address space identifier (ASID) for controlling accesses of a VM to encrypted memory pages, cache lines, and TLB entries. We then present the CROSSLINE attacks, a novel class of attacks against SEV that allow the adversary to launch an attacker VM and change its ASID to that of the victim VM to impersonate the victim. We present two variants of CROSSLINE attacks: CROSSLINE V1 decrypts victim's page tables or memory blocks following the format of a page table entry; CROSSLINE V2 constructs encryption and decryption oracles by executing instructions of the victim VM. We have successfully performed CROSSLINE attacks on SEV and SEV-ES processors.
