  Hardware-based Trusted execution environments (TEEs) offer an isolation
granularity of virtual machine abstraction. They provide confidential VMs
(CVMs) that host security-sensitive code and data. AMD SEV-SNP and Intel TDX
enable CVMs and are now available on popular cloud platforms. The untrusted
hypervisor in these settings is in control of several resource management and
configuration tasks, including interrupts. We present Heckler, a new attack
wherein the hypervisor injects malicious non-timer interrupts to break the
confidentiality and integrity of CVMs. Our insight is to use the interrupt
handlers that have global effects, such that we can manipulate a CVM's register
states to change the data and control flow. With AMD SEV-SNP and Intel TDX, we
demonstrate Heckler on OpenSSH and sudo to bypass authentication. On AMD
SEV-SNP we break execution integrity of C, Java, and Julia applications that
perform statistical and text analysis. We explain the gaps in current defenses
and outline guidelines for future defenses.
