Hacker News Reader

Comment by xioxox | Hacker News Reader

Terrible for those of us who use undervolting to keep their laptop as cool as possible. I hope they allow it enabled in the bios settings.

View on HN

"After carefully reviewing the CPU voltage setting modification, Intel is mitigating the issue in two parts, a BIOS patch to disable the overclocking mailbox interface configuration. Secondly, a microcode update will be released that reflects the mailbox enablement status as part of SGX TCB [Trusted Computing Base] attestation. The Intel Attestation Service (IAS) and the Platform Certificate Retrieval Service will be updated with new keys in due course. The IAS users will receive a ‘CONFIGURATION NEEDED’ message from platforms that do not disable the overclocking mailbox interface.”

Seems like you should be able to just avoid applying the bios patch. That said, you won't be able to keep your BIOS up to date.

But then again, the researchers state: "In the paper, we show that Plundervolt may affect SGX's attestation functionality" so they are apparently able to fake at least part of the attestation.

Also it will be interesting to see whether directly talking to the voltage regulation controller on the mobo will circumvent the microcode protection.

AFAICT, they were able to randomly flip bits in the enclave. Which isn't great, but doesn't yet break remote attestation as commonly used for DRM schemes, which involves online communication with both Intel and the enclave software provider. They can simply reject attestations if they detect too many authentication attempts from the same CPU, long before you manage to flip the correct bit.

IIRC, reading memory out of the enclave has already been accomplished with other side-channel attacks, so that aspect has been broken. What would be novel is if you could read the per-CPU secret key[1], but that doesn't appear to be what they've done.

[1] Which only Intel knows, which is why remote attestation requires a service contract with Intel for online verification of attestation responses.

> whether directly talking to the voltage regulation controller on the mobo

Is it even possible to do that without physical access?

Can you confirm that? Do modern motherboards expose an interface that allows directly control over the voltage regulation in software without physical access?! If so, it's terrifying...

I am talking working around attestation for someone who operates the computer and wants to subvert SGX enclaves. Whether you need physical access or not is thus inconsequential.

Wait, I won't be able to undervolt my CPU? What abput on linux? Intel decided that disabling functionality is a solution? Time for another PS3-type lawsuit.

FWIW, SGX is in Skylake and later. Time for AMD to shine I guess

the paper mentions TrustZone has (had?) similar issues:

> In 2017, Tang et al. [65] discovered a software-based fault attack, dubbed CLK screw. They discovered that ARM processors allow configuration of the dynamic frequency scaling feature, i.e., overclocking, by system software. Tang et al. show that overclocking features may be abused to jeopardize the integrity of computations for privileged adversaries in a Trusted Execution Environment (TEE). Based on this observation, they were able to attack cryptographic code running in TrustZone. They used their attack to extract cryptographic keys from a custom AES software implementation and to overcome RSA signature checks and subsequently execute their own program in the TrustZone of the System-on-Chip (SoC) on a Nexus 6 device.

it further notes though:

> However, their attack is specific to TrustZone on a certain ARM SoC and not directly applicable to SGX on Intel processors.

(ARM TrustZone is what AMD has in their chips)

I did a quick search on the paper, didn't find "google" nor "titan", which is the secure chip made by Google. Would it be vulnerable too?

> (ARM TrustZone is what AMD has in their chips)

Well, I'll be damned: "The PSP itself is an ARM core inserted on the main CPU.[6]" (https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...)

I'd imagine that the ARM core on the AMD CPU doesn't support changing the clock rate or anything much though.

Even if it does, you cannot execute unattested code on it and the voltage is pegged to CPU IO voltage. Undervolting that risks big fat immediate system crash, unlike undervolting a core.

Reply on news.ycombinator.com