Critical "Starbleed" vulnerability in FPGA chips identified

guest · Apr 17, 2020

Critical "Starbleed" vulnerability in FPGA chips identified
April 16, 2020
https://techxplore.com/news/2020-04-critical-starbleed-vulnerability-fpga-chips.html

Field programmable gate arrays, FPGAs for short, are flexibly programmable computer chips that are considered very secure components in many applications. In a joint research project, scientists from the Horst Görtz Institute for IT Security at Ruhr-Universität Bochum and from Max Planck Institute for Security and Privacy have now discovered that a critical vulnerability is hidden in these chips.

They called the security bug "Starbleed." Attackers can gain complete control over the chips and their functionalities via the vulnerability. Since the bug is integrated into the hardware, the security risk can only be removed by replacing the chips.

The security researchers will present the results of their work at the 29th Usenix Security Symposium to be held in August 2020 in Boston, Massachusetts, U.S..
The scientific paper has been available for download on the Usenix website since April 15, 2020.
Click to expand...

Market leader affected
As part of their research, the scientists analysed FPGAs from Xilinx, one of the two market leaders in field-programmable gate arrays. The Starbleed vulnerability affects Xilinx's 7-series FPGAs with the four FPGA families Spartan, Artix, Kintex and Virtex as well as the previous version Virtex-6, which form a large part of Xilinx FPGAs used today.

"We informed Xilinx about this vulnerability and subsequently worked closely together during the vulnerability disclosure process. Furthermore, it appears highly unlikely that this vulnerability will occur in the manufacturer's latest series," reports Amir Moradi. Xilinx will also publish information on its website for affected customers.
Click to expand...

The Unpatchable Silicon: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

In this paper, we introduce novel low-cost attacks against the Xilinx 7-Series (and Virtex-6) bitstream encryption, resulting in the total loss of authenticity and confidentiality. We exploit a design flaw which piecewise leaks the decrypted bitstream. In the attack, the FPGA is used as a decryption oracle, while only access to a configuration interface is needed. The attack does not require any sophisticated tools and, depending on the target system, can potentially be launched remotely. In addition to the attacks, we discuss several countermeasures.
Click to expand...

Log in or Sign up

Critical "Starbleed" vulnerability in FPGA chips identified

guest Guest

Log in or Sign up

Critical "Starbleed" vulnerability in FPGA chips identified

guest Guest

Useful Searches