Work

Reload+Reload: Exploiting Cache and Memory Contention Side Channel on AMD SEV

Year: 2025

Type: conference-paper

Abstract: To enhance the security of virtual machines (VMs) in multi-tenant cloud environments, AMD provides the Secure Encrypted Virtualization (SEV) extension to support encrypted VMs. We discovered two previously unknown side channels from AMD processors with SEV support: cache flush and memory contention side channels. Our findings apply to SEV-SNP and earlier versions of the technology (SEV and SEV-ES). We formulated two Reload+Reload (RR) attacks based on our two respective findings: Reload+Reload-flush-set (RRFS) and Reload+Reload-memory-block (RRMB). We demonstrated the effectiveness of the attacks against SEV-SNP protected VMs: we built a RRFS-based covert channel for a Spectre attack and used RRMB for extracting AES-128 secret keys. Compared to Prime+Probe-based implementations, our RRFS-based covert channel demonstrates superior noise resistance and higher capacity.

Source: ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS)

DOI: 10.1145/3676641.3716017

Authors: Li-Chung Chiang, Shih-Wei Li

Institution: National Taiwan University

Language: English

Topic: Security and Verification in Computing

Subfield: Artificial Intelligence

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Funder: National Science and Technology Council

OpenAlex ID: W4408893486

FWCI: 7.927

Cites: 9

Cited by: 8

Related to: 10