Mathias Oberhuber, Martin Unterguggenberger, and Martin Wistauder, Graz University of Technology; Andreas Kogler, Graz University of Technology Alumni; Rishub Nagpal and Stefan Mangard, Graz University of Technology
Confidential computing technologies, such as AMD SEV, enable secure execution of cloud workloads on shared physical hardware. AMD SEV technologies implement the VM trust model through AMD SEV-ES, encrypting memory and CPU register state, and AMD SEV-SNP, providing integrity protection for VM memory. While AMD SEV provides heavy-weight architectural isolation, it remains unclear whether it is susceptible to power side channels.
In this paper, we present PowerHooK, a new attack on AMD SEV technologies that enables software-based power side channels by speculatively replaying victim code paths via transient execution. Specifically, we repurpose page-fault-based transient replay to establish a transient-execution replay hook for power measurements. PowerHooK allows a malicious hypervisor to re-execute vulnerable victim code paths, thereby enabling continuous collection of power traces, reducing significant system noise. This capability allows the attacker to perform power analysis attacks on denoised datasets.
We demonstrate PowerHooK’s methodology by recovering AES key bytes across all AMD SEV defenses. Here, the attacker only needs to consider 1320 samples to perform a CPA on AES-NI executed in AMD SEV-SNP running in an experimental setting. We systematically analyze architectural, speculative, and transient power leakage across different AMD CPU generations and evaluate how AMD’s virtualization levels affect PowerHooK. Moreover, we present a real-world AES key byte recovery attack targeting VM-isolated cloud workers that run OpenSSL's constant-cycle AES-NI CBC implementation. Thereby, we demonstrate that transient replay gadgets are present in the OpenSSL library, showcasing that PowerHooK effectively enables the extraction of secrets.
