Racing for Privilege

## Overview

In the Black Hat presentation **"Racing for Privilege,"** researchers Sandro Rüegge and Johannes Wikner describe how they uncovered a microarchitectural race condition affecting recent Intel processors that allows unprivileged attackers to leak arbitrary memory across privilege boundaries.

The talk retraces the origins of the vulnerability back to the disclosure of Spectre in 2017, which revealed that speculative execution and shared branch target prediction structures could be exploited to bypass kernel/user and guest/host boundaries. While Intel deployed indirect branch restricted speculation (IBRS) and subsequently enhanced IBRS (eIBRS) to isolate prediction modes across privilege levels, the speakers discovered that eIBRS can be bypassed by racing the hardware pipeline during privilege-level transitions.

---

## The eIBRS Defense Model & Initial Inconsistencies

Spectre branch target injection works by training branch target prediction structures with attacker-controlled virtual addresses, priming the CPU cache, switching to a victim domain (such as the OS kernel) via a system call, and triggering speculative execution of a "disclosure gadget" to leak secret data through cache side channels.

To mitigate this: - Intel introduced **eIBRS** (configured by toggling a Model-Specific Register / MSR controlling speculation), designed as a "set-and-forget" mitigation. - eIBRS tags branch predictions with a **prediction mode** (e.g., distinguishing hypervisor, kernel, and user modes) to prevent cross-privilege branch prediction collisions.

When testing eIBRS behavior on modern Intel CPUs using a test kernel module invoked via `ioctl`: - The authors observed that injecting predictions across privilege boundaries stopped working, but surprisingly it also failed even when eIBRS was explicitly left disabled at boot. - On more modern processors, however, they noticed an elusive anomaly: an extremely faint signal—occurring roughly once in a million runs—where cross-privilege injection succeeded regardless of whether eIBRS was enabled or disabled.

---

## Experimental Methodology: Uncovering the System Call Link

To investigate this sporadic signal, Sandro Rüegge conducted hundreds of variations of the benchmark experiment to isolate the root cause:

1. **Cache Preparation Placement**: Moving the cache preparation phase into the kernel produced a much stronger signal, indicating that the failure was not an issue with the predictor alone. 2. **Handwritten Assembly & System Calls**: Rewriting test cases into raw assembly to eliminate compiler and runtime noise revealed that system call execution was the critical catalyst. 3. **Spamming Syscalls (`getpid`)**: Deliberately issuing system calls (such as `getpid`) immediately after branch training reliably reproduced a strong injection signal. 4. **Delay Variation**: Inserting variable delays using `NOP` instructions between branch training and the system call demonstrated a clear correlation: - When the delay between branch training and the system call was very short, branch injection succeeded at a high rate. - As the `NOP` delay increased, the success rate dropped sharply until injection ceased completely.

---

## Microarchitectural Race Condition Mechanism

Based on their verification experiments, the researchers deduced the internal hardware behavior:

- **Asynchronous Predictor Queuing**: In hardware, updating a branch target predictor is not instantaneous. The processor buffers the update in an internal queue or "assembly line" to gather metadata (such as branch target address and branch type) and locate an eviction candidate in the predictor structure. - **Race Condition on Privilege Transition**: If a system call triggers a privilege level transition while the pending branch update is still queued in this pipeline, the CPU records the *current* (elevated) privilege mode rather than the privilege mode active when the branch executed. - **eIBRS Tag Confusion**: Consequently, the user-space branch prediction is committed into the predictor tagged with kernel-level privileges, effectively bypassing eIBRS tagging defenses and enabling speculative control-flow hijacking within the kernel.