Critical SWAPGS Attack

In pursuit of ever-faster CPUs, vendors have implemented various versions of speculative execution. This functionality has the CPU making educated guesses about instructions that may be required before it determines whether the instructions are, in fact, required. This speculative execution may leave traces in cache that attackers can use to leak privileged, kernel memory.

This attack takes advantage of a combination of Intel speculative execution of a specific instruction (SWAPGS) and use of that instruction by Windows operating systems within what is known as a gadget.

What makes research into these attacks cutting-edge compared to cyber attacks against more traditional vulnerabilities is that it gets to the root of how modern CPUs operate. To properly investigate, research teams must thoroughly understand CPU internals (branch prediction, out-of-order execution, speculative execution, pipeline, and caches), OS internals (system calls, interrupt and exception handling and KPTI), and side-channel and speculative-execution attacks

• SWAPGS attack whitepaper
• Past Limited-Disclosure of Other Research From Bitdefender
• SWAPGS Attack demonstration video
• Demonstration of mitigation with hypervisor introspection
• New side-channel SWAPGS Attack workshop video

Since the publication of Meltdown and Spectre, researchers have scrutinized the speculative-execution feature of modern CPUs, particularly side-channel attacks targeting the performance-focused feature of modern CPUs.

Bitdefender researchers worked with Intel for more than a year before public disclosure of this new attack. Bitdefender has also worked closely with Microsoft, which developed and published a patch. Other vendors in the ecosystem have also been involved.

Bitdefender has published an in-depth whitepaper, including a detailed disclosure timeline, describing the research behind the attack. Bitdefender has also published blog posts explaining the attack and video demonstrating it.

"While deploying the patch from Microsoft is highly recommended, Bitdefender Hypervisor Introspection provides a compensating control that prevents attack."

Bitdefender has demonstrated how Hypervisor Introspection stops the attack by removing conditions it needs to succeed on unpatched Windows systems. This mitigation has introduced no noticeable performance degradation. While deploying the patch from Microsoft is highly recommended, Hypervisor Introspection provides an effective compensating control until systems can be patched.

Hypervisor Introspection analyzes the memory of guest VMs and identifies objects of interest. Bitdefender mitigated this vulnerability, before the release of any applicable patch, by instrumenting each vulnerable SWAPGS instruction to make sure it doesn’t execute speculatively, preventing kernel memory leaks.

Despite their best efforts, many organizations struggle to deploy patches on an ideal timeline. Hypervisor Introspection helps them bridge the gap between the release and deployment of patches for serious security vulnerabilities.

Hypervisor Introspection is unique to Bitdefender. Today, it is supported with Citrix Hypervisor, Xen, and KVM as a technology preview.

Hypervisor Introspection leverages inherent advantages gained from the position of hypervisors relative to underlying hardware and virtualized operating systems, including Windows, Linux, and desktop and server virtual machines. In real time, Hypervisor Introspection inspects the raw memory of running virtual machines. It looks for signs of memory-based attack techniques consistently used to exploit vulnerabilities, both known and unknown.

Hypervisor Introspection is a powerful security approach unique to Bitdefender. Bitdefender research and development worked with Xen Project to extend Virtual Machine Introspection (VMI) within Xen hypervisor. Citrix has adopted the functionality in Citrix Hypervisor as the Direct Inspect APIs. Bitdefender also continues to work with the KVM and other open-source communities, in addition to further research and development for non-virtualized scenarios such as embedded systems.

Another high-profile example of Hypervisor Introspection’s capabilities came before the release of EternalBlue, which was later used in the WannaCry ransomware wave. With no knowledge of the specific cyber attack or underlying vulnerability, Hypervisor Introspection blocked the attack, since it leverages a buffer overflow attack technique.

While leveraging buffer overflows to exploit vulnerabilities is not new, the WannaCry attackers’ rapid adoption of EternalBlue demonstrated, once again, that organizations often can’t deploy critical patches in time to prevent cyber attacks. Whether considering tried and true attack techniques such as buffer overflows, heap spray, and code injection, or highly sophisticated attacks that exploit vulnerabilities in the deepest levels of hardware functionality, it’s clear that organizations must weave a new security approach, such as Hypervisor Introspection, into their security fabric.

Hypervisor Introspection demonstrates how security, hardware, virtualization, and operating system vendors can cooperate to produce powerful new security approaches that stem the tide of highly sophisticated attacks.

The SWAPGS Attack exploits, via a side-channel attack, a flaw in the speculative-execution regime of modern Intel CPUs. This attack bypasses mitigation mechanisms put in place to thwart earlier attacks. Since the attack leverages the SWAPGS instruction when engaged speculatively, applying patches for operating systems that may use SWAPGS speculatively is highly recommended. Given the scope of research performed by the Bitdefender team that discovered the SWAPGS Attack, known-vulnerable systems are limited to those hosting the Windows operating system on modern Intel CPUs capable of running speculative execution. Until patches can be applied, it is highly recommended to move workloads running within vulnerable operating systems to hosts running Bitdefender Hypervisor Introspection via Citrix Hypervisor or Xen.

In May 2019, a Bitdefender blog post summarized research into another side-channel attack mechanism based on speculative execution. At the time, as covered in the disclosure timeline in the whitepaper, we agreed to hold back publication of the in-depth research whitepaper on the speculative-execution side-channel mechanisms discovered. The whitepaper, titled “Security implications of speculatively executing segmentation related instructions on Intel CPUs”, is co-authored by the same two researchers as the SWAPGS attack whitepaper, and is available here.