IdleLeak: Exploiting Idle State Side Effects for Information Leakage

IdleLeak: Exploiting Idle State Side Effects for Information Leakage

Speakers: Fabian Rauscher

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=oR7BvorNIA4

Overview

Fabian Rauscher's presentation at the NDSS Symposium unveils IdleLeak, a novel side-channel attack that exploits previously unexplored behaviors of modern CPU idle states. Modern processors incorporate sophisticated energy management features, transitioning CPU cores into various idle states, traditionally using privileged instructions like hlt. However, Intel's recent introduction of the WAITPKG x86 ISA extension made two new sub-states of the C0 running state, C0.1 and C0.2, accessible from user space via the tpause and umwait instructions. This unprivileged access dramatically expands the attack surface, allowing an attacker to manipulate or monitor CPU idle states without requiring kernel privileges. IdleLeak demonstrates how these seemingly innocuous power-saving features can be repurposed for significant information leakage.

The research details two primary attack techniques: ActiveIdleLeak and PassiveIdleLeak. ActiveIdleLeak exploits the performance-increasing side effects of the C0.2 idle state, where a logical core entering C0.2 can boost the performance of a sibling logical core by relinquishing shared resources. PassiveIdleLeak, on the other hand, leverages undocumented wake-up triggers of both C0.1 and C0.2, allowing an attacker to detect system activity, including interrupts and exceptions, even across physical cores or virtual machine boundaries. The implications are profound, enabling high-throughput covert channels, precise keystroke timing attacks, and sophisticated website and video fingerprinting, ultimately exposing highly sensitive user data and challenging fundamental assumptions about software isolation.

Background

▶ Watch: Introduction to IdleLeak and its significant security implications (0:00)

The foundation of IdleLeak rests on several key technologies and security research areas. Simultaneous Multithreading (SMT), known as Hyper-Threading on Intel CPUs, allows multiple logical cores to execute instruction streams concurrently on a single physical core. This interleaving of instructions improves overall performance by maximizing the utilization of execution units, often yielding a 30% performance gain. However, this efficiency comes at a cost: logical cores competitively share on-core resources like caches and Translation Lookaside Buffers (TLBs), leading to potential contention and performance degradation for single-threaded workloads, a known source of side channels.

Side-channel attacks have long been a critical area of security research, focusing on extracting sensitive information by observing unintentional system emissions rather than exploiting direct vulnerabilities. Historically, these attacks targeted cryptographic primitives by analyzing execution time, power consumption, or electromagnetic radiation. More recently, research has expanded to user input, particularly inter-keystroke timings, which can reveal typed text patterns. Covert communication channels, where a sender and receiver collaborate to exfiltrate data, have also been demonstrated across various microarchitectural elements, virtual machines (VMs), and even web browsers. Many prior attacks primarily focused on scenarios where the attacker and victim shared the same or sibling logical cores, as microarchitectural elements are often not shared across physical cores, though cross-core attacks for globally shared elements are also known.

Crucial to IdleLeak are Processor Power States (C-States), defined by the Advanced Configuration and Power Interface (ACPI). C0 represents the running state, while C1 through Cn denote progressively deeper idle states that conserve more power but incur higher entry and exit latencies. Older Intel x86 processors primarily used the privileged hlt instruction for C1. To optimize for short idle periods and avoid expensive system calls, Intel introduced the pause instruction for busy-waiting in C0, and later MONITOR and MWAIT for waiting on memory writes and transitioning to deeper C-states. The game-changer for IdleLeak is the recent WAITPKG x86 ISA extension, which introduced the tpause and umwait instructions. Unlike mwait, tpause and umwait are accessible at all privilege levels and are restricted to two sub-states of the C0 running state: C0.1 and C0.2. These instructions provide an efficient, low-latency way for user programs to enter these idle states, optimizing busy waits and reducing energy consumption by 5-13% compared to a busy wait, with a 22% faster wake-up time. C0.2 specifically offers the added benefit of increasing the performance of sibling logical cores by relinquishing resources. Intel recommends tpause for user-level busy polling, synchronization, and asynchronous I/O due to its low wake-up latency. Notably, tpause is also documented to wake up due to non-maskable interrupts, system management interrupts, machine check exceptions, and external interrupts, irrespective of the RFLAGS.IF flag.

IdleLeak builds upon and significantly expands prior research. While Zhang et al. (68) explored umwait for interrupt detection in native code, demonstrating its use for Spectre-type attacks and website fingerprinting, their work did not investigate other undocumented interrupt wake-up triggers, the security implications of unprivileged modification of idle states, or the behavior of these states in VMs, nor the tpause instruction. IdleLeak specifically delves into these unexplored aspects. In keystroke timing, previous works like Ristenpart et al. (42) used interrupt detection for synchronization, Schwarz etal. (48) used rdtsc, and Lipp et al. (27) used JavaScript. IdleLeak provides a new, robust method. For covert channels, Zhang et al. (68) achieved 200 kbit/s, Gast et al. (9) 2.7 Mbit/s, and Saileshwar et al. (45) 14.4 Mbit/s. IdleLeak demonstrates comparable or faster rates via different mechanisms. In website fingerprinting, Spreitzer et al. (53) achieved 89% accuracy on Android, Jana et al. (19) 30-50% with memory usage, and Gulmezoglu et al. (13) 86.3% with hardware performance events. Zhang et al. (68) achieved a 70% F1 score using mwait. IdleLeak significantly surpasses these F1 scores. For video fingerprinting, Reed et al. (40, 41) exploited DASH throughput changes for over 90% accuracy, and Gu et al. (12) achieved 90% with bitrate-independent traffic analysis. IdleLeak is the first to demonstrate video fingerprinting based on interrupt detection via a side channel, achieving high F1 scores with significantly shorter measurement times.

Key Findings

▶ Watch: Practical attacks: keystroke timing, website and video fingerprinting (0:55)

The IdleLeak research uncovers several critical findings and makes substantial contributions to system security:

• Comprehensive Security Analysis of C0.1 and C0.2: The work provides the first in-depth analysis of the security properties of the C0.1 and C0.2 idle states, which are directly manipulable by unprivileged user-space attackers. This analysis led to the discovery and development of the IdleLeak attack primitives.
• Novel Undocumented Behaviors: Crucially, IdleLeak identifies several previously undocumented behaviors of these new idle states:
• Cross-Core Wake-ups: Both C0.1 and C0.2 can be woken up by activity (including interrupts) on sibling logical cores.
• Sibling Core Exception Wake-ups (C0.1): C0.1 specifically wakes up due to exceptions (e.g., divide-by-zero, page fault, general protection fault) intended for sibling logical cores, a significant advantage for attackers as it doesn't induce a VM exit on the attacker's core.
• Cross-VM Wake-ups: tpause within a guest VM unexpectedly wakes up due to host interrupts, enabling a VM-based attacker to monitor host activity.
• High-Throughput Covert Channels: IdleLeak enables robust and high-capacity covert channels. ActiveIdleLeak achieves a true capacity of up to 7.1 Mbit/s in native scenarios and 46.3 kbit/s in cross-VM settings. PassiveIdleLeak, utilizing interrupt detection, yields 656.37 kbit/s natively. These rates are comparable to or faster than many existing covert channels.
• Accurate Keystroke-Timing Attacks: The research demonstrates a native keystroke-timing attack using PassiveIdleLeak, achieving an impressive F1 score of 90.5% and a remarkably low timing prediction error of just 12 microseconds. This attack functions reliably across CPU cores, independent of where the victim's code is scheduled.
• Effective Website Fingerprinting: IdleLeak facilitates powerful website fingerprinting attacks, achieving F1 scores of 93.1% in a closed-world setting and 85.2% in an open-world setting over the top 100 websites.
• First Interrupt-Detection-Based Video Fingerprinting: The work introduces a novel technique for video fingerprinting based on interrupt detection, successfully distinguishing videos on platforms like YouTube and PornHub with high F1 scores (up to 90.2% for YouTube closed-world) using only the first 10 seconds of a video.
• Fundamental Challenge to Isolation: These undocumented behaviors fundamentally challenge existing assumptions about software isolation and security boundaries, particularly between processes on sibling cores and between guest VMs and their hosts.
• Severe Privacy Implications: The information leaked through IdleLeak, which can include highly sensitive privacy-related data like browsing habits, video consumption, and even potentially sexual preferences, poses a significant risk for malicious purposes such as extortion campaigns.

Technical Deep Dive

▶ Watch: Key finding: Cross-core and cross-VM attack capabilities (1:00)

IdleLeak exploits the side effects of Intel's C0.1 and C0.2 idle states, which are made accessible to user-level applications via the tpause and umwait instructions of the WAITPKG extension. The attack primitives are divided into ActiveIdleLeak, leveraging performance side effects, and PassiveIdleLeak, exploiting undocumented interrupt detection capabilities.

ActiveIdleLeak: Exploiting Performance Side Effects of C0.2

ActiveIdleLeak capitalizes on the documented, yet security-unexplored, performance-increasing side effects of the C0.2 idle state. When a logical core enters C0.2 using tpause, it relinquishes some of its on-core resources. These resources include critical microarchitectural elements such as load buffers, store buffers, and reorder-buffer entries. The release of these resources significantly boosts the single-threaded performance of its sibling logical core on the same physical CPU core.

Extensive micro- and macro-benchmarks confirmed these effects. Macro-benchmarks on an Intel i7-13900K, using workloads like SPEC CPU 2017 and Stress-NG, showed an average performance increase of 31% on the sibling logical core when the other core was in C0.2, compared to a busy wait. Specific benchmarks like memcpy, futex, and crypt saw gains of +100%, +89%, and +70% respectively. Micro-benchmarks focusing on single-cycle x86 instructions like add, xor, and mov revealed a median speedup of approximately 80%. The nop instruction, whose throughput is often limited by the core's frontend and reorder buffer, showed the most dramatic boost, nearly 90%, making it an ideal candidate for constructing a covert channel due to its predictable and significant performance change.

The ActiveIdleLeak covert channel leverages this performance differential. A sender thread and a receiver thread run on sibling logical cores. The receiver continuously measures the execution time of a series of nop instructions. To send a '0' bit, the sender enters the C0.2 idle state using tpause for a predefined time slice, causing the receiver's nop execution time to substantially decrease. To send a '1' bit, the sender performs a busy wait for the duration of the time slice, which does not affect the receiver's performance, resulting in a higher nop execution time. The receiver decodes bits by averaging nop execution times within each slice and comparing against a threshold, clearly distinguishing '0' (around 60 cycles) from '1' (around 80 cycles) with minimal overlap.

PassiveIdleLeak: Exploiting Undocumented Interrupt Detection

PassiveIdleLeak exploits the undocumented wake-up behaviors of both C0.1 and C0.2. The research found that these idle states are woken up by various processor operations, including external interrupts, special instructions, user input, and scheduling events. This allows an attacker to effectively monitor system activity.

For interrupt monitoring, the attacker sets the tpause deadline to its maximum value. This ensures that the instruction only wakes up due to an interrupt rather than a timer expiration. The tpause instruction also sets the carry flag if woken by an operating system deadline, providing a reliable mechanism to distinguish interrupt-induced wake-ups. Unlike umwait, tpause does not spuriously wake up due to memory activity, making it a less noisy channel for interrupt detection.

A critical finding is that C0.1 is influenced by activity on sibling logical cores, and, surprisingly, both C0.1 and C0.2 are affected by activity in the host system even when the attacker is running inside a virtual machine (VM). This cross-VM behavior allows a VM-based attacker to detect host timer interrupts and touchpad activity. When a host interrupt occurs, it causes a VM exit, but the execution returns from tpause in the guest, allowing the guest to observe the event. By filtering out regular timer interrupts, specific host activities become distinctly visible.

An even more profound undocumented behavior was discovered for C0.1: it wakes up not only on interrupts intended for the waiting core but also on interrupts and exceptions (e.g., divide-by-zero, page fault, general protection fault) intended for sibling logical cores. This is a significant advantage for an attacker because it does not induce a VM exit on the attacker's logical core. Instead, the attacker can immediately re-enter C0.1 after detecting the interrupt, ready for the next one, making it highly efficient. This behavior, coupled with the non-security-aware scheduling of interrupts on x86, makes mitigation particularly challenging. While this sibling-logical-core interrupt-waking behavior was not observed for C0.2, disabling C0.1 access without fully disabling the entire WAITPKG extension is not possible, as both C0.1 and C0.2 are accessed via tpause and umwait.

The PassiveIdleLeak covert channel also uses sibling logical cores. The receiver monitors the interrupt frequency of the sibling logical core using PassiveIdleLeak. To send a '1' bit, the sender generates exceptions (specifically, divide-by-zero exceptions, chosen for not requiring memory access) until the end of the time slice, leading to a higher interrupt count on the receiver's core. To send a '0' bit, the sender performs a busy wait, generating fewer interrupts. The channel starts with an initialization sequence of 16 '1'-bits, allowing the receiver to compute a dynamic threshold for decoding subsequent bits.

Both ActiveIdleLeak and PassiveIdleLeak covert channels utilize time slicing and the Time-Stamp Counter (TSC) for synchronization. Transmission begins at a pre-agreed TSC value, and bits are sent in time slices of predefined length. The use of TSC for deadlines in tpause inherently re-synchronizes the channel with each operation, making it robust.

Demo / Proof of Concept

▶ Watch: Intel's WAITPKG: new user-accessible C0.1 and C0.2 states (3:05)

Fabian Rauscher's talk demonstrated the practical applicability and severity of IdleLeak through several real-world attack scenarios, implemented and evaluated on modern Intel processors (i9-13900K and i7-1260P running Ubuntu 22.04).

Covert Channel Demonstrations

The covert channel capabilities were rigorously evaluated by sending data from /dev/urandom between attacker and victim processes running on sibling logical cores.

• Native ActiveIdleLeak Covert Channel: Achieved a peak true capacity of 7.1 Mbit/s (i9-13900K) and 5.9 Mbit/s (i7-1260P) with relatively low bit-error ratios (3.2% and 4.4% respectively). System noise analysis showed I/O workloads had no significant impact, but CPU workloads could severely degrade capacity, dropping to almost 0 Mbit/s with sufficient stress threads, particularly on laptop CPUs due to thermal throttling.
• Cross-VM ActiveIdleLeak Covert Channel: Demonstrated successful cross-VM communication with a true capacity of 46.32 kbit/s (i9-13900K) and 13.57 kbit/s (i7-1260P), both with very low bit-error ratios (0.22% and 2.1%).
• Native PassiveIdleLeak Covert Channel: Achieved a true capacity of 656.37 kbit/s (i9-13900K) with a raw capacity of 1179 kbit/s and a bit-error ratio of 9.22%.

Keystroke Detection Attack

For the inter-keystroke timing attack, the attacker recorded an interrupt trace using PassiveIdleLeak on the CPU core responsible for receiving USB interrupts. USB keyboards generate distinct key-down and key-up interrupts for each keypress. The attack utilized an ARM Mbed LPC-1768 micro-controller board to inject pre-recorded keystroke timing data from the Keystroke100 Dataset, comprising 7000 inter-keystroke timings from 100 participants. The attacker ran multiple threads to ensure one was scheduled on the interrupt-receiving core. The attack effectively works across cores, independent of the victim's code scheduling. Keystroke interrupts were distinguished from other system interrupts by identifying pairs within a specific time window (10ms to 100ms).

The evaluation showed remarkable accuracy: a precision of 87.1%, a recall of 94.1%, and an F1 score of 90.5%. The average deviation was 15.2 µs, and for correctly detected keystrokes, the standard error on timing prediction was an exceptionally low 12 microseconds. Recovered and ground-truth inter-keystroke timing distributions were almost identical.

Website and Video Fingerprinting Attacks

These attacks involved an attacker VM spying on a victim's Mozilla Firefox 113.0.2 browser running on the host machine (Ubuntu 22.04). The attacker executed PassiveIdleLeak on the CPU core receiving the host's network device interrupts.

• Website Fingerprinting:
• Data Collection: The attacker VM continuously recorded interrupt traces using PassiveIdleLeak.
• Detection: Website access was identified by characteristic changes in interrupt frequency, specifically a decrease in low-frequency components (0.2, 0.4, and 0 Hz) over multiple Short-Time Fourier Transform (STFT) windows, indicating network activity.
• Classification: STFT was applied to 512 windows of the interrupt trace, preserving time-domain information, and fed into a Convolutional Neural Network (CNN) consisting of 4 convolutional layers and 3 fully connected layers. The target was the top 100 websites from the Alexa top 1 million list.
• Results:
• Closed-World Same-Core: F1 score of 88.2%. Grouping frequently confused Google domains boosted this to 90%.
• Closed-World Sibling-Logical-Core: F1 score increased to 92.4%, and with Google domain grouping, reached 93.1%. This improvement highlights C0.1's ability to detect sibling core interrupts without VM exits, reducing noise.
• Open-World: Including an "other-class" for unknown websites, a macro-averaged F1 score of 85.2% was achieved, with the "other-class" itself having 87.4% accuracy.

• Video Fingerprinting:
• Data Collection: Interrupt traces were measured for only the first 10 seconds of a video stream.
• Transformation: Instead of direct STFT, the number of interrupts per millisecond was first counted, and this transformed trace was then fed into an STFT, which proved more efficient for video streams characterized by short bursts of high interrupt counts.
• Classification: The STFT output was fed into a CNN with 4 convolutional layers and 3 fully connected layers. The targets were the top 20 trending videos on YouTube and the top 20 most viewed videos in popular categories on PornHub.
• Results:
• YouTube (20 trending videos): Closed-world F1 score of 90.2%; open-world F1 score of 81.5%.
• PornHub (20 most viewed videos): Closed-world F1 score of 75%; open-world F1 score of 70.5%. The lower scores for PornHub were attributed to lower default video resolutions (720p/480p vs. 1080p on YouTube) and platform-specific intros interfering with fingerprinting.

Defensive Implications

▶ Watch: IdleLeak's novel contributions differentiating from prior research (4:15)

The IdleLeak research exposes fundamental security flaws in the design of new user-controlled idle states, particularly concerning cross-process and cross-VM confidentiality. The tpause instruction, while intended for efficiency, significantly expands the attack surface for unprivileged attackers. The core issue lies in the fact that interrupt scheduling on x86 does not adhere to side-channel-aware policies, and the architecture implies specific interrupt assignments to cores, making software-only mitigations challenging and often detrimental to performance.

Several potential mitigations were explored, each with its own trade-offs:

1. Disabling WAITPKG: It is technically possible to disable the WAITPKG extension for user space, thereby preventing access to tpause and umwait. However, this is largely impractical as many applications rely on TSC-related instructions, and disabling C0.2 alone (forcing a fallback to C0.1) does not address C0.1's inherent issues. For virtual machines, disabling WAITPKG is feasible but incurs a measurable performance degradation of approximately 2% on an i7-1260P.
2. Isolated IRQ Core: Dedicating at least one physical CPU core solely to handling external interrupts could prevent their detection on other cores. However, this mitigation is incomplete, as C0.1's undocumented wake-ups from sibling logical core exceptions and in/out-port instructions would still be exploitable. Furthermore, this approach comes with a significant performance impact, causing a 4.8% decrease in performance on an i7-1260P.
3. IRQ Randomization: Regularly randomizing the core assignments of external interrupts could introduce noise, making fingerprinting attacks harder by making interrupt traces less predictable. While this doesn't fully mitigate the attacks, it could reduce leakage. However, it introduces performance and energy overhead, though no significant overhead was observed with 0.5-second reassignment intervals on an i7-1260P.
4. Hardware Changes (Most Effective): The research strongly advocates for hardware-level changes as the most effective and comprehensive solution. This would involve:

• Removing Undocumented Wake-ups: Eliminating the undocumented wake-ups of C0.1 on exceptions and external interrupts intended for sibling logical cores.
• VM Exit Alignment: Modifying the behavior of tpause within VMs to align with that of the older hlt instruction, meaning it should not wake up on VM exits. This would resolve the interrupt-related security issues for virtual-machine-based attackers and limit the attack surface in native scenarios. The fact that the older privileged mwait instruction did wake on VM exits suggests this was the intended, more secure behavior.

1. Other Potential Mitigations: Generic software solutions like trapping tpause/umwait instructions or injecting fake interrupts to create noise were considered. However, these incur significant performance and energy costs that may not be justified for the marginal reduction in leakage they provide. Noise injection, by its nature, only reduces the signal-to-noise ratio, not fully mitigating the underlying leakage.

The conclusion is clear: due to the low-level x86 interrupt architecture and the fundamental nature of these undocumented behaviors, hardware-based mitigations are ultimately necessary. Removing wake-up reasons, except for those strictly confined to the same core's interrupt handling, is a viable and critical approach to restoring isolation and confidentiality.

Key Takeaways

• New Attack Surface: Intel's user-accessible C0.1 and C0.2 idle states (tpause, umwait) introduce a novel and significant side-channel attack surface, enabling unprivileged attackers to leak sensitive information.
• High-Capacity Covert Channels: IdleLeak facilitates highly effective covert channels, achieving up to 7.1 Mbit/s natively (ActiveIdleLeak) and 656.37 kbit/s natively (PassiveIdleLeak), with cross-VM capabilities up to 46.3 kbit/s.
• Precise Monitoring Capabilities: The attacks enable remarkably accurate keystroke-timing (F1 score 90.5%, 12 µs error) and powerful website/video fingerprinting (up to 93.1% F1 for websites, 90.2% F1 for YouTube videos) using interrupt traces.
• Undocumented Cross-Core and Cross-VM Leakage: A critical finding is the undocumented wake-up of C0.1/C0.2 by activity on sibling logical cores and, surprisingly, the wake-up of tpause in VMs due to host interrupts, fundamentally breaking isolation boundaries.
• Software Mitigations are Insufficient: Due to the low-level architectural nature of these issues and the non-side-channel-aware x86 interrupt scheduling, effective software-only mitigations are difficult to implement without significant performance penalties.
• Hardware Changes are Essential: The research strongly advocates for hardware-level changes to remove undocumented wake-up triggers and align tpause behavior in VMs with secure isolation principles, as the ultimate solution to address these fundamental security flaws.

About the Speaker(s)

Fabian Rauscher is a researcher who presented his work, "IdleLeak: Exploiting Idle State Side Effects for Information Leakage," at the NDSS Symposium. The presentation highlights his expertise in system security, microarchitectural side channels, and processor architecture.