FLUSH+RELOAD: A High Resolution, Low Noise, L3 Cache Side-Channel Attack

By Yuval Yarom, Katrina E. Falkner. USENIX Security Symposium, 2014

1,714 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/447611b97696bf363409371fa6ffb7befc36e5b7

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Foreshadow-NG: Breaking the virtual memory abstraction with transient out-of-order execution (2018, unknown): “, using a cache-based covert channel [10].”
SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution (2018, methodology): “ME-PROBE techniques [68] to extract secrets from the enclave code, only if the enclave code has secret-dependent memory access patterns. Though more ﬁne-grainedand less noisy, FLUSH-RELOAD techniques [82] cannot be used in SGX attacks because enclaves do not share memorywith the external world. Diff”
Controlled-Channel Attacks: Deterministic Side Channels for Untrusted Operating Systems (2015, methodology): “[50] has shown that the amount of noise in the cache side channel can be significantly reduced if the victim and the attacker share memory.”
Cross-Tenant Side-Channel Attacks in PaaS Clouds (2014, methodology): “The technique was later extended by Yarom and Falkner to multi-core systems with a shared last-level cache [38].”
CacheBleed: a timing attack on OpenSSL constant-time RSA (2016, methodology): “Examples of the latter include timing attacks which measure timing variations of cryptographic operations [9,18,19] and cache attackswhich observe cache access patterns [45,46,54].”
Last-Level Cache Side-Channel Attacks are Practical (2015, methodology): “Consequently, an attacker process that can trace the execution of the square-and-multiply exponentiation algorithm can recover the exponent [2, 45, 47].”
Jump over ASLR: Attacking branch predictors to bypass ASLR (2016, background): “A large number of prior works studied different aspects of side channels in instruction and data caches [55], [56], [57], [58], [59].”
Flush+Flush: A Fast and Stealthy Cache Attack (2015, methodology): “Access-driven cache attacks are typically devised in two types: Prime+Probe [29, 31,38] and Flush+Reload [11, 44].”
Survey of Attacks and Defenses on Edge-Deployed Neural Networks (2019, methodology): “For example, in Cache Telepathy [38], attackers use the Flush+Reload [39] and Prime+Probe [40] cache SC attacks to measure the size of general matrix multiply (GEMM) operations, ﬁrst counting the number of parameters in the model, and then narrowing down the model architecture.”
Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript (2015, methodology): “Flush+Reload has been introduced by Gullasch et al. [14] and Yarom and Falkner [39].”
Cache Template Attacks: Automating Attacks on Inclusive Last-Level Caches (2015, methodology): “This is the basis for the Flush+Reload [56] attack as described in Section 2.3.”
Wait a Minute! A fast, Cross-VM Attack on AES (2014, methodology): “in [33] suggested that their attack could be used in a virtualized environment but they never tried it in a real cloud environment.”
Translation Leak-aside Buffer: Defeating Cache Side-channel Protections with TLB Attacks (2018, methodology): “Next we perform a similar evaluation on RSA code implemented in libgcrypt , that was written to be constant-time in order to mitigate FLUSH + RELOAD [59], but nevertheless leaves a secret-dependent data trace.”
CATalyst: Defeating last-level cache side channel attacks in cloud computing (2016, background): “The last-level cache (LLC) is one of the most dangerous shared resources since it is shared by all of the cores in a processor package, yet it allows fine-grained, high-bandwidth, low-noise cross-core attacks [22, 29, 42].”
A survey of microarchitectural timing attacks and countermeasures on contemporary hardware (2016, background): “Yarom and Falkner [169] demonstrated a Flush+Re-load attack on the LLC (Intel Core i5-3470 and Intel Xeon E5-2430) for attacking RSA, requiring read access to the in-memory RSA implementation, through either memory mapping or page de-duplication.”