BREAKING AT&T Data Breach: ‘Nearly All’ Wireless Customers Exposed in Massive Hack
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Endpoint Security

New TikTag Attack Targets Arm CPU Security Feature 

Researchers have targeted the MTE security feature in Arm CPUs and showed how attackers could bypass protections.

CPU attack

Researchers have disclosed the details of a new speculative execution attack that targets a hardware security feature present in Arm CPUs, allowing an attacker to bypass protections.

The attack method was discovered by a team of researchers representing Seoul National University, Samsung Research, and the Georgia Institute of Technology. A paper describing their findings was published last week. 

The researchers targeted Memory Tagging Extension (MTE), a security feature introduced by Arm with the 8.5-A architecture to detect memory corruption. 

They demonstrated that by using so-called TikTag gadgets, an attacker could use speculative execution to leak MTE tags from arbitrary memory addresses, which would allow them to exploit memory corruption vulnerabilities for arbitrary code execution, privilege escalation, data leakage, or denial of service.

The attack method was successfully demonstrated against the Chrome web browser and the Linux kernel, with the researchers showing how an attacker could bypass MTE defenses to exploit memory corruption vulnerabilities.  

“Our evaluation results show that TikTag gadgets can leak MTE tags with a success rate higher than 95% in less than 4 seconds,” the researchers said.

In order to help others understand MTE side-channel issues, the researchers have open-sourced their TikTag gadgets

In response to this and other research into MTE tags, Arm recently explained, “MTE can provide a limited set of deterministic first line defences, and a broader set of probabilistic first line defences, against specific classes of exploits. However, the probabilistic properties are not designed to be a full solution against an interactive adversary that is able to brute force, leak, or craft arbitrary Address Tags.”

Advertisement. Scroll to continue reading.

Arm also noted that “Allocation Tags are not expected to be a secret to software in the address space” and thus “a speculative mechanism that reveals the correct tag value is not considered a compromise of the principles of the architecture”. 

Related: Arm Warns of Exploited Kernel Driver Vulnerability

Related: Future Intel, AMD and Arm CPUs Vulnerable to New ‘SLAM’ Attack

Related: Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

ICS and OT cybersecurity solutions provider TXOne Networks appoints Stephen Driggers as new CRO

Identity orchestration provider Strata Identity appoints Aldo Pietropaolo as Field CTO

Cybersecurity provider for the aviation industry Cyviation has appointed Eliran Almog as Chief Executive Officer.

More People On The Move

Expert Insights