Automatic ISA analysis for Secure Context Switching

2025-02-10

AI Summary

ISA state management has long been neglected; its complexity—encompassing hundreds of registers and instructions, along with concurrent multi-register modifications—frequently leads privileged software to omit saving sensitive state during context switches, thereby enabling side-channel and privilege-escalation vulnerabilities. Method: We propose the first ISA state security-sensitivity classification algorithm grounded in Sail formal specifications, integrating static data-flow analysis with automated annotation to systematically identify states requiring protection. Contribution/Results: Our approach uncovers three categories of ISA state-handling defects across four open-source confidential computing systems, revealing five exploitable security vulnerabilities accessible to unprivileged attackers. This work establishes ISA state as a system-level attack surface for the first time and provides a formally verifiable foundation for state protection in trusted execution environments.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Machine Learning: Hardware-aware ML
• Intelligent Robots: State Estimation

Application Category

• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Virtualization and resource management in Web systems and infrastructures
• Semantics and Knowledge: Provenance, trust, security and privacy, and ethical issues in managing semantic data

Abstract

Instruction set architectures are complex, with hundreds of registers and instructions that can modify dozens of them during execution, variably on each instance. Prose-style ISA specifications struggle to capture these intricacies of the ISAs, where often the important details about a single register are spread out across hundreds of pages of documentation. Ensuring that all ISA-state is swapped in context switch implementations of privileged software requires meticulous examination of these pages. This manual process is tedious and error-prone. We propose a tool called Sailor that leverages machine-readable ISA specifications written in Sail to automate this task. Sailor determines the ISA-state necessary to swap during the context switch using the data collected from Sail and a novel algorithm to classify ISA-state as security-sensitive. Using Sailor's output, we identify three different classes of mishandled ISA-state across four open-source confidential computing systems. We further reveal five distinct security vulnerabilities that can be exploited using the mishandled ISA-state. This research exposes an often overlooked attack surface that stems from mishandled ISA-state, enabling unprivileged adversaries to exploit system vulnerabilities.

Problem

• Automates ISA-state analysis for secure context switching
• Identifies security-sensitive ISA-state using Sail specifications
• Exposes vulnerabilities from mishandled ISA-state in systems

Innovation

• Automates ISA analysis
• Classifies security-sensitive ISA-state
• Identifies system vulnerabilities