A Systematic Evaluation of Transient Execution Attacks and Defenses

By Claudio Canella, Jo Van Bulck, Michael Schwarz, Moritz Lipp, Benjamin Berg, Philipp Ortner, Frank Piessens, Dmitry Evtyushkin, Daniel Gruss. USENIX Security Symposium, 2018

458 citations recorded by the source corpus.

Research on transient execution attacks including Spectre and Meltdown showed that exception or branch misprediction events might leave secret-dependent traces in the CPU's microarchitectural state. This observation led to a proliferation of new Spectre and Meltdown attack variants and even more ad-hoc defenses (e.g., microcode and software patches). Both the industry and academia are now focusing on finding effective defenses for known issues. However, we only have limited insight on residual attack surface and the completeness of the proposed defenses. In this paper, we present a systematization of transient execution attacks. Our systematization uncovers 6 (new) transient execution attacks that have been overlooked and not been investigated so far: 2 new exploitable Meltdown effects: Meltdown-PK (Protection Key Bypass) on Intel, and Meltdown-BND (Bounds Check Bypass) on Intel and AMD; and 4 new Spectre mistraining strategies. We evaluate the attacks in our classification tree through proof-of-concept implementations on 3 major CPU vendors (Intel, AMD, ARM). Our systematization yields a more complete picture of the attack surface and allows for a more systematic evaluation of defenses. Through this systematic evaluation, we discover that most defenses, including deployed ones, cannot fully mitigate all attack variants.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

View Paper: https://www.semanticscholar.org/paper/5e9305469683288d4a5883314cae2386355af068

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Signal Processing

Citations in the corpus

ZombieLoad: Cross-Privilege-Boundary Data Sampling (2019, background): “ve results are squashed in the reorder buffer. We refer to instructions that are executed speculatively or out-of-order but whose results are never architecturally committed as transient instructions [9, 45, 68]. Whiletheresultsandthearchitecturaleffectsoftransientinstructions are discarded, measura”
Fallout: Leaking Data on Meltdown-resistant CPUs (2019, methodology): “Meltdown-type attacks [5, 10, 39, 40, 46, 51, 72, 74, 78] exploit the transient execution of instructions before a fault is handled.”