A team of researchers has disclosed the details of a new attack method affecting a security feature present in AMD processors, demonstrating the risk it can pose to protected virtual machines (VMs).
The attack method, named CacheWarp, was discovered by researchers from the CISPA Helmholtz Center for Information Security in Germany, the Graz University of Technology in Austria, and independent researcher Youheng Lu.
CacheWarp affects AMD Secure Encrypted Virtualization (SEV), a CPU extension designed for isolating VMs from the underlying hypervisor at the hardware level, enabling developers to securely deploy VMs even if the hypervisor is untrusted. AMD SEV provides protection by encrypting VM data, including memory and register state.
The feature, particularly the new SEV-SNP (Secure Nested Paging), is highly useful for protecting sensitive data in cloud environments, securing VMs even against compromised or untrusted cloud providers.
According to the researchers who discovered the attack method, CacheWarp can allow malicious hackers to hijack control flow, break into an encrypted VM, and escalate privileges.
“For a simple example,” the researchers explained, “assume you have a variable determining whether a user is successfully authenticated. By exploiting CacheWarp, an attacker can revert the variable to a previous state and thus take over an old (already authenticated) session. Furthermore, an attacker can manipulate the return address stored on the stack and, by that, change the control flow of a victim program.”
In a CacheWarp attack scenario, the attacker (a malicious hypervisor) has elevated privileges, but has no control over the data or code inside the targeted VM.
CacheWarp has been described as a software-based fault injection attack that is possible due to a hardware issue in AMD CPUs. The researchers pointed out that the root cause is an architectural bug, and CacheWarp is not a transient-execution or side-channel attack, like many other CPU attack methods disclosed in recent years.
CacheWarp can impact any system powered by an AMD CPU that supports SEV, but only users who deploy secure virtual machines using SEV are at risk of attacks.
The underlying vulnerability is tracked as CVE-2023-20592. AMD, which learned about the issue in April 2023, has published its own security advisory, providing information on impacted products and patches.
The researchers have made available a paper detailing their findings and they have launched a dedicated website that provides a high-level summary of the CacheWarp attack.
They have also published a couple of videos showing how the vulnerability can be exploited to bypass OpenSSH authentication and escalate privileges to root via Sudo.
Related: New ‘Inception’ Side-Channel Attack Targets AMD Processors
Related: Retbleed: New Speculative Execution Attack Targets Intel, AMD Processors
Related: New ‘Hertzbleed’ Remote Side-Channel Attack Affects Intel, AMD Processors
Related: Chipmaker Patch Tuesday: Intel, AMD Address Over 100 Vulnerabilities