SMoTherSpectre: exploiting speculative execution through port contention

Abstract

Spectre, Meltdown, and related attacks have demonstrated that kernels, hypervisors, trusted execution environments, and browsers are prone to information disclosure through micro-architectural weaknesses. However, it remains unclear as to what extent other applications, in particular those that do not load attacker-provided code, may be impacted. It also remains unclear as to what extent these attacks are reliant on cache-based side channels. We introduce SMoTherSpectre, a speculative code-reuse attack that leverages port-contention in simultaneously multi-threaded processors (SMoTher) as a side channel to leak information from a victim process. SMoTher is a fine-grained side channel that detects contention based on a single victim instruction. To discover real-world gadgets, we describe a methodology and build a tool that locates SMoTher-gadgets in popular libraries. In an evaluation on glibc, we found hundreds of gadgets that can be used to leak information. Finally, we demonstrate proof-of-concept attacks against the OpenSSH server, creating oracles for determining four host key bits, and against an application performing encryption using the OpenSSL library, creating an oracle which can differentiate a bit of the plaintext through gadgets in libcrypto and glibc.

References in corpus (2)

• ret2spec: Speculative Execution Using Return Stack Buffers
• Automated Instruction Stream Throughput Prediction for Intel and AMD Microarchitectures

Cited by in corpus (12)

• GhostMinion: A Strictness-Ordered Cache System for Spectre Mitigation
• Last-Level Cache Side-Channel Attacks Are Feasible in the Modern Public Cloud (Extended Version)
• SoK: Hardware Defenses Against Speculative Execution Attacks
• Hacky Racers: Exploiting Instruction-Level Parallelism to Generate Stealthy Fine-Grained Timers
• Malware in the SGX supply chain: Be careful when signing enclaves!
• Libra: Architectural Support For Principled, Secure And Efficient Balanced Execution On High-End Processors (Extended Version)
• A Survey of Security Concerns and Countermeasures in Modern Micro-architectures with Transient Execution
• On Value Recomputation to Accelerate Invisible Speculation
• VeriFence: Lightweight and Precise Spectre Defenses for Untrusted Linux Kernel Extensions
• SMaCk: Efficient Instruction Cache Attacks via Self-Modifying Code Conflicts
• Distributed systems and trusted execution environments: Trade-offs and challenges
• Leaking Secrets through Modern Branch Predictor in the Speculative World