A Systematic Evaluation of Transient Execution Attacks and Defenses

Abstract

Research on transient execution attacks including Spectre and Meltdown showed that exception or branch misprediction events might leave secret-dependent traces in the CPU's microarchitectural state. This observation led to a proliferation of new Spectre and Meltdown attack variants and even more ad-hoc defenses (e.g., microcode and software patches). Both the industry and academia are now focusing on finding effective defenses for known issues. However, we only have limited insight on residual attack surface and the completeness of the proposed defenses. In this paper, we present a systematization of transient execution attacks. Our systematization uncovers 6 (new) transient execution attacks that have been overlooked and not been investigated so far: 2 new exploitable Meltdown effects: Meltdown-PK (Protection Key Bypass) on Intel, and Meltdown-BND (Bounds Check Bypass) on Intel and AMD; and 4 new Spectre mistraining strategies. We evaluate the attacks in our classification tree through proof-of-concept implementations on 3 major CPU vendors (Intel, AMD, ARM). Our systematization yields a more complete picture of the attack surface and allows for a more systematic evaluation of defenses. Through this systematic evaluation, we discover that most defenses, including deployed ones, cannot fully mitigate all attack variants.

References in corpus (9)

• SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Execution
• Speculative Buffer Overflows: Attacks and Defenses
• LazyFP: Leaking FPU Register State using Microarchitectural Side-Channels
• Intel MPX Explained: An Empirical Study of Intel MPX and Software-based Bounds Checking Approaches
• SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks
• SafeSpec: Banishing the Spectre of a Meltdown with Leakage-Free Speculation
• oo7: Low-overhead Defense against Spectre Attacks via Program Analysis
• You Shall Not Bypass: Employing data dependencies to prevent Bounds Check Bypass
• The Heisenberg Defense: Proactively Defending SGX Enclaves against Page-Table-Based Side-Channel Attacks

Cited by in corpus (11)

• Raziel: Private and Verifiable Smart Contracts on Blockchains
• Fallout: Reading Kernel Writes From User Space
• PerSpectron: Detecting Invariant Footprints of Microarchitectural Attacks with Perceptron
• ConTExT: Leakage-Free Transient Execution
• SoK: Hardware Defenses Against Speculative Execution Attacks
• Write Me and I'll Tell You Secrets -- Write-After-Write Effects On Intel CPUs
• SpectreRewind: Leaking Secrets to Past Instructions
• SPEECHMINER: A Framework for Investigating and Measuring Speculative Execution Vulnerabilities
• ProSpeCT: Provably Secure Speculation for the Constant-Time Policy (Extended version)
• Revisiting and Evaluating Software Side-channel Vulnerabilities and Countermeasures in Cryptographic Applications
• Simplex: Repurposing Intel Memory Protection Extensions for Information Hiding