Security researchers have identified a novel side-channel attack that can compromise the security of modern Intel CPUs variants, including Raptor Lake and Alder Lake. The attack, dubbed Indirector, leverages weaknesses in the Indirect Branch Predictor (IBP) and the Branch Target Buffer (BTB) to bypass existing defenses and steal sensitive information from processors.
The IBP is a critical hardware component in modern CPUs that predicts the target addresses of indirect branches. Indirect branches are control flow instructions whose target address is computed only at runtime, making them challenging to predict accurately.
Attacks using Branch Target Injection (BTI) in their operations have been the focus of extensive research by security experts since the discovery of the Spectre and Meltdown attacks in 2018.
Indirector CPU Vulnerability
The Indirector attack developed by University of California San Diego researchers exploits weaknesses in Intel CPUs to launch precise Branch Target Injection (BTI) attacks. Attackers can use a custom tool called the iBranch Locator to locate any indirect branch and then perform precision-targeted IBP and BTB injections to execute speculative code. This allows attackers to steal sensitive information from the processor using a side-channel attack.
This tool enables two high-precision attacks:
- IBP Injection Attack: Locates and injects arbitrary target addresses into victim IBP entries.
- BTB Injection Attack: Injects malicious targets into the victim’s BTB entry, misleading it through BTB prediction.
These attacks can potentially bypass existing defenses and compromise system security across various scenarios, including cross-process and cross-privilege situations. The paper has stated that while Intel has already offered several mitigations to protect the BTB and IBP from different types of target injection attacks, such as Indirect Branch Restricted Speculation (IBRS), Single Thread Indirect Branch Predictors (STIBP), and Indirect Branch Predictor Barrier, these defenses were found inadequate and did not always correspond to advertised goals.
The researchers stated their surprise on the discovery of potential attack surfaces despite the implementation of these measures. The research paper behind the study has three main important contributions:
- The paper presents the first major analysis of the Indirect Branch Predictor and its interaction with the Branch Target Buffer in the recent Intel processor families. The paper details the size, structure, and precise indexing and tagging hash functions.
- The paper analyzes mitigation mechanisms (IBRS, STIBP, and IBPB) on Intel CPUs designed to protect against BTB and IBP target injection attacks.
- The paper demonstrated the use of the iBranch Locator as an efficient tool with the capability of locating any indirect branches within the IBP without requiring prior data on the the branch. The paper highlights that by using this tool, attackers can successfully break address space layout randomization.
Intel Indirector Mitigations
For Intel processors, researchers recommend more aggressive use of the Indirect Branch Predictor Barrier (IBPB) and suggest the incorporation of more fine-grained BPU isolation across security domains in future CPU designs.
Possible further mitigations include a more aggressive use of the Indirect Branch Predictor Barrier (IBPB) and hardening the Branch Prediction Unit (BPU) design through the incorporation of more complex tags, encryption, and randomization. The researchers disclosed their findings to Intel in February 2024, with the researchers stating that Intel had informed other affected hardware and software vendors about the vulnerability.
The researchers’ discoveries underscore the importance of ongoing scrutiny and analysis of hardware components and the need for chip manufacturers to continually improve their designs to stay ahead of potential threats.
The authors thanked anonymous reviewers for helpful suggestions on the research paper.
