[tor-bugs] #13912 [Core Tor/Tor]: Key Security: Zeroing Buffers Is Insufficient (AES-NI leaves keys in SSE registers)

Tor Bug Tracker & Wiki blackhole at torproject.org
Sun Jul 9 06:51:05 UTC 2017


#13912: Key Security: Zeroing Buffers Is Insufficient (AES-NI leaves keys in SSE
registers)
-------------------------------------------------+-------------------------
 Reporter:  teor                                 |          Owner:
     Type:  defect                               |         Status:  new
 Priority:  Medium                               |      Milestone:  Tor:
                                                 |  unspecified
Component:  Core Tor/Tor                         |        Version:  Tor:
                                                 |  0.2.6.1-alpha
 Severity:  Normal                               |     Resolution:
 Keywords:  security registers aesni memwipe     |  Actual Points:
  tor-relay                                      |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by cypherpunks):

 Replying to [comment:5 yawning]:
 > Ooof.  This is tricky to solve correctly, but the AES-NI case is
 probably not exploitable.  From talking with nickm on IRC about this, the
 only way for this to actually leak AES keys would be:
 >
 >  * Bugs that allow arbitrary code execution (we've lost in that case
 regardless)
 >  * Something that reads from a uninitialized XMM register in a way that
 spits it out onto heap/stack/the network, while displaying "correct"
 behavior otherwise.
 >  * Your kernel is compromised (we've lost in that case regardless) since
 the registers get saved on context switch.

 What about ROP gadgets that do not provide turing complete behavior (so no
 "arbitrary" code execution), but still expose the sensitive registers?
 There will certainly be gadgets for reading from these registers.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13912#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online


More information about the tor-bugs mailing list