Bypassing KPTI Using the Speculative Behavior of the SWAPGS Instruction

Bitdefender senior researchers Dan Horea Luțaș and Andrei Vlad Luțaș recently uncovered a new speculative-execution vulnerability and demonstrated how it can be exploited via a side-channel style attack, dubbed SWAPGS Attack. The vulnerability has been publicly reported today as CVE-2019-1125.

While side-channel attacks have been known for some time now, speculative execution-based attacks are new, and signs indicate they will linger on for some time. To date, the most famous examples are Meltdown, Spectre, L1TF, and Microarchitectural Data Sampling (MDS).
Speculative execution allows the CPU to execute instructions before knowing whether the results are required. Vulnerabilities in speculative-execution can be exploited via side-channel attacks. Successful exploitation allows an unprivileged attacker to bypass basic memory isolation enforcement provided by hardware. This allows attackers to gain access to privileged data which would normally not be accessible to unprivileged processes.

Mitigations for this class of vulnerabilities are tricky to implement. They generally fall into three categories: hardware fixes, software mitigations or microcode mitigations. All previously exposed side-channel attacks are mitigated by at least one of the three approaches.

In a technical whitepaper published today, Bitdefender researchers describe the SWAPGS Attack. The attack is a novel approach of leaking sensitive information from the kernel since it bypasses all known side-channel attack mitigation techniques. This is achieved by abusing the fact that SWAPGS instruction can be executed speculatively. An attacker can force arbitrary memory dereferences in kernel, which leaves traces within the data caches. These signals can be picked-up by the attacker to infer the value located at the given kernel address.

Existing mitigations are provided by Bitdefender through the Hypervisor Introspection (HVI). HVI is available for Citrix Hypervisor and is in technology preview for KVM hypervisor.