AEPIC Leak: Architecturally Leaking Uninitialized Data from the Microarchitecture

AEPIC Leak is an architectural CPU bug that leaks stale data from the microarchitecture without using a side channel. It works on recent Sunny-Cove-based Intel CPUs and does not require hyperthreading enabled. The attack samples data transferred between the L2 and last-level cache, including SGX enclave data, from the superqueue. The only short-term mitigations for AEPIC Leak are to disable APIC MMIO or not rely on SGX.

• AEPIC Leak is the first architectural CPU bug that leaks stale data from the microarchitecture without using a side channel
• It works on recent Sunny-Cove-based Intel CPUs and does not require hyperthreading enabled
• The attack samples data transferred between the L2 and last-level cache, including SGX enclave data, from the superqueue
• The only short-term mitigations for AEPIC Leak are to disable APIC MMIO or not rely on SGX

The presenters demonstrated how they were able to connect to a system in their home country and locate an AES Enclave that used the ASNI instruction set to perform encryption. They were able to disassemble the enclave and locate the instruction called vas Tegan assist, which generated the round keys from the root key. By stopping the enclave at that moment, they were able to extract the private key that they wanted to leak. They were able to perform their attack and recover the ASNI key of that encryption within seconds.

CPU vulnerabilities undermine the security guarantees provided by software- and hardware-security improvements. While the discovery of transient-execution attacks increased the interest in CPU vulnerabilities on a microarchitectural level, architectural CPU vulnerabilities are still understudied.In this talk, we systematically analyze existing CPU vulnerabilities showing that CPUs suffer from vulnerabilities whose root causes match with those in complex software. We show that transient-execution attacks and architectural vulnerabilities often arise from the same type of bug and identify the blank spots. Investigating the blank spots, we focus on architecturally improperly initialized data locations.We discover AEPIC Leak, the first architectural CPU bug that leaks stale data from the microarchitecture without using a side channel. AEPIC Leak works on all recent Sunny-Cove-based Intel CPUs (i.e., Ice Lake and Alder Lake) and does not require hyperthreading enabled. It architecturally leaks stale data incorrectly returned by reading undefined APIC-register ranges. AEPIC Leak samples data transferred between the L2 and last-level cache, including SGX enclave data, from the superqueue. We target data in use, e.g., register values and memory loads, as well as data at rest, e.g., SGX-enclave data pages. Even if AEPIC Leak is a sampling-based attack, we introduce techniques to precisely influence from which page and offset the attack leaks from. Our end-to-end attack extracts AES-NI, RSA, and even the Intel SGX attestation keys from enclaves within a few seconds. We discuss mitigations and conclude that the only short-term mitigations for AEPIC Leak are to disable APIC MMIO or not rely on SGX.