Flushgeist: Cache Leaks from Beyond the Flush
arXiv:2005.13853
Abstract
Flushing the cache, using instructions like clflush and wbinvd, is commonly proposed as a countermeasure against access-based cache attacks. In this report, we show that several Intel caches, specifically the L1 caches in some pre-Skylake processors and the L2 caches in some post-Broadwell processors, leak information even after being flushed through clflush and wbinvd instructions. That is, security-critical assumptions about the behavior of clflush and wbinvd instructions are incorrect, and countermeasures that rely on them should be revised.
arXiv comment6 pages, 4 figures
References in corpus (4)
- The Cost of Application-Class Processing: Energy and Performance Analysis of a Linux-ready 1.7GHz 64bit RISC-V Core in 22nm FDSOI Technology
- Software Grand Exposure: SGX Cache Attacks Are Practical
- Robust and Efficient Elimination of Cache and Timing Side Channels
- Prevention of Microarchitectural Covert Channels on an Open-Source 64-bit RISC-V Core