A new speculative execution attack named “TIKTAG” targets ARM’s Memory Tag Extension (MTE) to leak data with more than a 95% chance of success, allowing hackers to bypass the security feature.
See also: London hospitals cancel operations after ransomware attack
The paper, co-authored by a team of Korean researchers from Samsung, Seoul National University, and the Georgia Institute of Technology, demonstrates the attack against Google Chrome and the Linux.
MTE is a feature added to the ARM v8.5-A (and later), designed to detect and prevent memory corruption.
The system uses low-overhead tags, assigning 4-bit tags to 16-byte chunks of memory , to protect against memory corruption attacks by ensuring that the tag on the pointer matches the memory area being accessed .
MTE has three operating modes: synchronous, asynchronous , and asymmetric, balancing security and performance.
The researchers found that using two gadgets (code), namely TIKTAG-v1 and TIKTAG-v2, they can exploit the speculative execution attack to leak MTE memory tags with a high success rate and in a short time.
See also: Financial sector: Cyberattacks and ways to protect yourself
Leaking these tags does not directly expose sensitive data such as passwords, encryption keys, or personal information. However, it could theoretically allow attackers to undermine the protections provided by MTE, rendering the security system ineffective against secret memory corruption attacks.
The researchers reported their findings in the affected entities between November and December 2023 and received an overall positive response, although no immediate fixes have been applied.
The technical paper published on arxiv.org suggests the following mitigations against TIKTAG attacks:
- Modify the hardware design to prevent speculative execution from altering the hidden memory states based on tag check results.
- Insert speculative execution barriers (e.g., sb or isb instructions) to prevent speculative execution of critical memory operations.
- Add filler instructions to extend the execution window between branch instructions and memory accesses.
- Improve sandboxing mechanisms to restrict speculative memory access paths strictly within safe memory regions.
While ARM recognized the seriousness of the situation and published a bulletin a few months ago, it does not consider this a violation of the feature.
See also: Ascension: Recent attack was caused by downloading a malicious file
A speculative execution attack, such as TIKTAG, exploits the process by which a CPU executes tasks in advance, predicting instructions that may be needed for future workloads. This technique, while designed to optimize performance, can inadvertently expose sensitive data. By corrupting the speculative execution mechanism, attackers can access memory locations that should not be accessible, potentially compromising user data and system security. Mitigating these threats often involves both software patches and hardware redesigns to ensure a secure processing environment without sacrificing the benefits of speculative execution.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Source: bleepingcomputer
