SEV-Step: A Single-Stepping Framework for AMD-SEV

TL;DR

This paper introduces SEV-Step, a framework enabling reliable single-stepping and attack primitives on AMD SEV virtual machines, facilitating microarchitectural attack research and demonstrating vulnerabilities including cache attacks and instruction information leaks.

Contribution

SEV-Step is the first reusable framework for single-stepping AMD SEV VMs, providing attack primitives and demonstrating new vulnerabilities like Nemesis-style attacks.

Findings

SEV can be reliably single-stepped using SEV-Step.

SEV-Step enables cache attacks that leak encryption keys.

SEV is vulnerable to instruction information leakage attacks.

Abstract

The ever increasing popularity and availability of Trusted Execution Environments (TEEs) had a stark influence on microarchitectural attack research in academia, as their strong attacker model both boosts existing attack vectors and introduces several new ones. While many works have focused on Intel SGX, other TEEs like AMD SEV have recently also started to receive more attention. A common technique when attacking SGX enclaves is single-stepping, where the system's APIC timer is used to interrupt the enclave after every instruction. Single-stepping increases the temporal resolution of subsequent microarchitectural attacks to a maximum. A key driver in the proliferation of this complex attack technique was the SGX-Step framework, which offered a stable reference implementation for single-stepping and a relatively easy setup. In this paper, we demonstrate that SEV VMs can also be reliably single-stepped. To lay the foundation for further microarchitectural attack research against SEV, we introduce the reusable SEV-Step framework. Besides reliable single-stepping, SEV-Step provides easy access to common attack primitives like page fault tracking and cache attacks against SEV. All features can be used interactively from user space. We demonstrate SEV-Step's capabilities by carrying out an end-to-end cache attack against SEV that leaks the volume key of a LUKS2-encrypted disk. Finally, we show for the first time that SEV is vulnerable to Nemesis-style attacks, which allow to extract information about the type and operands of single-stepped instructions from SEV-protected VMs.