Researchers have disclosed the details of a new speculative execution attack that targets a hardware security feature present in Arm CPUs, allowing an attacker to bypass protections.
The attack method was discovered by a team of researchers representing Seoul National University, Samsung Research, and the Georgia Institute of Technology. A paper describing their findings was published last week.
The researchers targeted Memory Tagging Extension (MTE), a security feature introduced by Arm with the 8.5-A architecture to detect memory corruption.
They demonstrated that by using so-called TikTag gadgets, an attacker could use speculative execution to leak MTE tags from arbitrary memory addresses, which would allow them to exploit memory corruption vulnerabilities for arbitrary code execution, privilege escalation, data leakage, or denial of service.
The attack method was successfully demonstrated against the Chrome web browser and the Linux kernel, with the researchers showing how an attacker could bypass MTE defenses to exploit memory corruption vulnerabilities.
“Our evaluation results show that TikTag gadgets can leak MTE tags with a success rate higher than 95% in less than 4 seconds,” the researchers said.
In order to help others understand MTE side-channel issues, the researchers have open-sourced their TikTag gadgets.
In response to this and other research into MTE tags, Arm recently explained, “MTE can provide a limited set of deterministic first line defences, and a broader set of probabilistic first line defences, against specific classes of exploits. However, the probabilistic properties are not designed to be a full solution against an interactive adversary that is able to brute force, leak, or craft arbitrary Address Tags.”
Arm also noted that “Allocation Tags are not expected to be a secret to software in the address space” and thus “a speculative mechanism that reveals the correct tag value is not considered a compromise of the principles of the architecture”.
Related: Arm Warns of Exploited Kernel Driver Vulnerability
Related: Future Intel, AMD and Arm CPUs Vulnerable to New ‘SLAM’ Attack
Related: Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
