Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing

on YouTube ↗31m

" summary

Shows a practical side‑channel that leaks branch‑level control flow from SGX by running colliding shadow branches outside the enclave and reading prediction results via the CPU’s LBR while using an APIC timer and cache disabling to single‑step the enclave. Implements LBR‑based history inference and an APIC‑based interrupt synchronizer, builds shadow code that shares BTB entries with target branches, and recovers RSA private‑key bits with ~99.8% per‑bit accuracy; proposes branch‑history flushing (hardware) and a compiler transform (cmov+indirect) that costs ~30% runtime.

AI-written summary · about

" chapters (13)

1. 0:00Intro
2. 0:27Intel Software Guard Extension (SGX)
3. 2:59Branch shadowing: A fine-grained side- channel attack against Intel SGX Can attack each branch instruction
4. 5:31Branch collision timing attack works for SGX but has limitations
5. 8:44How does branch shadowing overcome the two limitations? Apply LBR to a shadow branch to identify branch prediction results instead of timing
6. 10:11Step 1: Prepare a shadow copy of an SGX program to monitor it with LBR
7. 10:59Step 2: Interrupt SGX execution and monitor shadow code with LBR
8. 11:45Shadow conditional branch and
9. 14:59Near single-stepping: Frequent timer and disabled cache
10. 15:55Attack evaluation: Sliding-window exponentiation
11. 19:49Hardware countermeasure: Flush branch history at SGX mode switch Most effective, but need hardware modification
12. 20:53Software mitigation: Branch obfuscation
13. 21:29Example of branch obfuscation

" related talks

• 13mExploiting Inaccurate Branch History in Side-Channel AttacksAlessandro Biondi, Yuhui Zhu · USENIX Security '25
• 14mBranch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by...Kaveh Razavi, Sandro Rüegge, Johannes Wikner · USENIX Security '25
• 54mWhen Good Turns Evil: Using Intel SGX to Stealthily Steal BitcoinsMichael Schwarz, Moritz Lipp · Black Hat Asia 2018
• 25mAutomatic Inference of Enclave Placement in LLVM CompilerAnitha Gollamudi, Wesley B Nuzzo, Mohamed Elwakil · PriSC 2025 (with POPL 2025)
• 19mRethinking Isolation Mechanisms for Datacenter MultitenancyVarun Gandhi, James Mickens · HotCloud '20
• 01h 46mA little Introduction to Control Flow IntegrityJames McNellis · Meeting C++ 2025
• 25mForeshadow: Extracting the Keys to the Intel SGX Kingdom...Jo Van Bulck · USENIX Security '18
• 27mControl Flow Integrity on RISC-VSylvain Guilley · Week of Open Source Hardware 2019