Privilege escalation attack through address space identifier corruption in untrusted modern processors

Abstract

Privilege escalation attacks are one of the major threats jeopardizing microprocessor operation. Such attacks aim to maliciously increase the privilege level of the executed process, in order to access unauthorized resources. Modern microprocessors include complex memory management modules, with various different privilege levels and numerous ways to change the privilege level. In this paper, we present a malicious modification in the microprocessor process switch mechanism. Contrary to recent work presented in literature, the modification can be deployed during manufacturing process, as it consists of a trivial addition of a gate or wire sizing. The minimal footprint, however, comes at the cost of small window of attack opportunities. Experimental results show that a modification-aware application can gain escalated privileges within a few thousand clock cycles. Moreover, the malicious code has been added to SPEC benchmarks, and we show that the modified benchmarks can get escalated privileges before the end of typical workload, with minimal performance overhead.