teecert/speechminer

SpeechMiner

SpeechMiner is an open-source framework for analyzing Meltdown-like speculative execution side-channel vulnerabilities. Refer to our NDSS'20 paper for more details.

Build Kernel Modules and SGX-STEP Components

The framework contains a few page table manipulation components from SGX-STEP.

To build the tool framework, part of the SGX-STEP toolset needs to be built. The related code is extracted to libsgxstep directory and kernel_sgxstep directory. kernel_sgxstep includes the kernel module used by libsgxstep. Due to extra dependency over linux-sgx-driver, please download and build the Linux SGX Driver.

git clone https://github.com/intel/linux-sgx-driver.git
cd linux-sgx-driver
sudo apt-get install linux-headers-$(uname -r)
make
sudo mkdir -p "/lib/modules/"`uname -r`"/kernel/drivers/intel/sgx"    
sudo cp isgx.ko "/lib/modules/"`uname -r`"/kernel/drivers/intel/sgx"    
sudo sh -c "cat /etc/modules | grep -Fxq isgx || echo isgx >> /etc/modules"    
sudo /sbin/depmod
sudo /sbin/modprobe isgx

Afterwards, build kernel_sgxstep.

cd kernel_sgxstep
make

To build libsgxstep, perform

cd libsgxstep
make

and check for the appearance of libsgxstep.a.

Then build the second kernel module.

cd kernel_setexec
make

If you are using a new linux version, the page table structure variables may be renamed to a 5-layer one. A quick fix is to rename them accordingly. (The fix is under development.) In case of a definition error (typically caused by linux kernel updates, as the current version is written for linux 4.10.3), try replacing the relevant function names to the correct ones. For example, native_read_cr3() is not available in linux 5.8. Replace it with __native_read_cr3() instead.

After the two kernel modules are compiled, load them with

sudo insmod kernel_sgxstep/sgx-step.ko
sudo insmod kernel_setexec/setexec.ko

Build SpeechMiner Library and Tests

In the root directory, execute

make

to build everything. If you are using a new linux version, you may encounter error: conflicting types for ‘pkey_set’. In such cases, simply rename the function (as well as its references) to pkey_set_.

There is also a 32-bit library and test suites located in directory 32-bit to test segmentation-related vulnerabilities.

cd 32-bit
make

Run Tests

To perform tests, simply execute the generated executables. For example, to test SMAP-related vulnerability, run

sudo ./new_physical_reader_test_smap

Reference

SPEECHMINER: A Framework for Investigating and Measuring Speculative Execution Vulnerabilities

Yuan Xiao, Yinqian Zhang, Mircea-Radu Teodorescu, Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA, Feb. 2020.

speechminer's Issues

Update licence to GPLv3

Dear authors,

Congrats on the paper and thank you for open-sourcing your code!

I noticed that the code in this repository is partially based on components from the SGX-Step code base. As the author of SGX-Step, I very much welcome that people build upon and extend the code! However, I noticed that the current license specifies SpeechMiner is released under the Apache License 2.0. Please note that this permissive license is not compatible with the explicit GPLv3 copyleft license of SGX-Step.

I explicitly opted to license SGX-Step under GPLv3 as I feel this is the right choice for a research project and to ensure that any derivations will remain open. This means that, when building your project on top of SGX-Step, the resulting code has to be entirely GPLv3 licensed (this holds for both the SGX-Step kernel and user-space components). Thus, under the terms of the GPLv3 license, SpeechMiner must also be considered as GPLv3. Could you please update the LICENSE file to correctly reflect this?

See also more info on Apache vs. GPL licensing here.