Retbleed can leak kernel memory from Intel processors at about 219 bytes per second and with 98 percent accuracy. The exploit can extract kernel memory from AMD CPUs with a bandwidth of 3.9 kB per second. The researchers said it was able to locate and leak a Linux computer’s root password hash from physical memory in about 28 minutes when running an Intel CPU and in about six minutes for an AMD CPU.
Retbleed works by using code that essentially poisons the branch prediction unit that CPUs rely on to make guesses. Once the poisoning is complete, this BPU will make false predictions that the attacker can control.
“We found that we can inject branch targets located within the kernel address space, even as an unprivileged user,” the researchers wrote in a blog post. “Although we cannot access branch targets within the kernel address space – branching to such a target results in a page fault – the branch prediction unit will update itself after observing the branch and assume that it was executed legally, even if it is to a kernel address.”
Intel and AMD respond
Both Intel and AMD responded with advice. Intel has confirmed that the vulnerability exists on Skylake-generation processors that do not have a built-in protection known as Enhanced Indirect Restricted Speculation (eIBRS).
“Intel has been working with the Linux community and VMM vendors to provide customers with software mitigation guidance that should be available on or around today’s public release date,” Intel wrote in a blog post. “Note that Windows systems are not affected as these systems use Indirect Restricted Speculation (IBRS) by default, which is also a mitigation available to Linux users. Intel is not aware of this issue being exploited outside of a controlled lab environment.”
AMD, meanwhile, has also released instructions. “As part of its ongoing work to identify and respond to new potential security vulnerabilities, AMD recommends that software vendors consider taking additional steps to protect against Spectre-like attacks,” the spokesperson wrote in an email. The company also published a white paper.
Both the research paper and the blog post explain the microarchitectural requirements necessary to exploit Retbleed:
Intel. On Intel, returns start to behave as indirect hops when the Return Stack Buffer, which contains the predictions of the return target, is insufficient. This happens after executing deep call stacks. In our evaluation, we found over a thousand such conditions that can be triggered by a system call. An indirect branch target predictor for Intel CPUs was studied in previous work.
AMD. On AMD, returns will behave like an indirect branch regardless of the state of their return address stack. In fact, by poisoning the return instruction using an indirect jump, the AMD branch predictor will assume that it will encounter an indirect jump instead of a return and consequently predict an indirect branch target. This means that any return we can reach via a system call can be used – and there are tons of them.
In an email, Razavi added, “Retbleed is more than just bypassing retpolin on Intel, especially on AMD machines. AMD will actually release a white paper introducing Branch Type Confusion based on Retbleed. Essentially, Retbleed makes AMD CPUs confuse rollback instructions with indirect branches. This makes exploiting returns very trivial on AMD CPUs.”
Mitigation will come at a cost that the researchers measured between 12 and 28 percent more computational cost. Organizations that rely on the affected CPUs should carefully read the researchers’, Intel’s and AMD’s publications and be sure to follow the mitigation guidelines.
This story originally appeared on Ars Technica.