Flush+Flush: A Fast and Stealthy Cache Attack

By Daniel Gruss, Clémentine Maurice, Klaus Wagner, Stefan Mangard. International Conference on Detection of intrusions and malware, and vulnerability assessment, 2015

651 citations recorded by the source corpus.

Research on cache attacks has shown that CPU caches leak significant information. Proposed detection mechanisms assume that all cache attacks cause more cache hits and cache misses than benign applications and use hardware performance counters for detection. In this article, we show that this assumption does not hold by developing a novel attack technique: the Flush+Flush attack. The Flush+Flush attack only relies on the execution time of the flush instruction, which depends on whether data is cached or not. Flush+Flush does not make any memory accesses, contrary to any other cache attack. Thus, it causes no cache misses at all and the number of cache hits is reduced to a minimum due to the constant cache flushes. Therefore, Flush+Flush attacks are stealthy, i.e., the spy process cannot be detected based on cache hits and misses, or state-of-the-art detection mechanisms. The Flush+Flush attack runs in a higher frequency and thus is faster than any existing cache attack. With 496i?źKB/s in a cross-core covert channel it is 6.7 times faster than any previously published cache covert channel.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering

View Paper: https://www.semanticscholar.org/paper/976e60b1fa5c68e603e65bde88f9fa9623e6b5bc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

Citations in the corpus

Meltdown: Reading Kernel Memory from User Space (2018, methodology): “The advantage of the Flush+Reload cache covert channel is the noise resistance and the high transmission rate [5].”
A Systematic Evaluation of Transient Execution Attacks and Defenses (2018, background): “Cache attack senders can be implemented in very little code [57, 61, 24], for instance via “tmp = array[secret_byte * 4096];”, i.”
Context-Sensitive Fencing: Securing Speculative Execution via Microcode Customization (2019, background): “Cache-based side-channel attacks have been shown to reveal secret information such as cryptographic keys [27, 38, 100], keystrokes [37], and browsing activity [70] by colocating a spy process alongside a victim in such a way that”
ZombieLoad: Cross-Privilege-Boundary Data Sampling (2019, background): “ttacker to observe the location of memory accesses. The granularity of the location observation depends on the spatial accuracy of the used side channel. Most common memory-based side-channel attacks [20, 22, 23, 25, 37, 56, 58, 71, 78, 79] have a granularity between one cache line [22, 23, 25, 79] ”
ARMageddon: Cache Attacks on Mobile Devices (2015, background): “We implemented this covert channel using Evict+Reload, Flush+Reload, and Flush+Flush on our smartphones.”
Peeking Behind the Curtains of Serverless Platforms (2018, background): “Cross-tenant VM sharing in Azure plus the ability to run arbitrary binaries in the function instance could make applications vulnerable to many kinds of side-channel attacks [16, 17, 20, 45].”
DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks (2015, methodology): “[5] implemented cross-core covert channels using Prime+Probe and Flush+Reload as well as a new one, Flush+Flush, with the same protocol to normalize the results.”
Another Flip in the Wall of Rowhammer Defenses (2017, background): “Several works detect ongoing attacks using hardware- and software-based performance counters [17, 18, 25, 28, 56, 75].”
Telling Your Secrets without Page Faults: Stealthy Page Table-Based Attacks on Enclaved Execution (2017, methodology): “We therefore chose to adopt a novel technique called FLUSH+FLUSH [16] that abuses microarchitectural timing differences in the execution time of the x86 clflush instruction, which depends on whether the data is cached or not.”
Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript (2015, methodology): “At the software level, one proposed countermeasure is the detection using hardware performance counters [4,12,15,30].”
Fallout: Leaking Data on Meltdown-resistant CPUs (2019, methodology): “Both Flush+Reload and Prime+Probe have been used as high-performance covert channels [28, 52, 56].”
DAWG: A Defense Against Cache Timing Attacks in Speculative Execution Processors (2018, background): “Furthermore, even though domains can fill only in their own ways, an attacker is free to flush shared cache lines regardless where they are cached, allowing straightforward transmission to an attacker’s receiver via flush&reload, or flush&flush [20].”
Spectre Attacks: Exploiting Speculative Execution (2018, background): “Recent results include cross-core and cross-CPU attacks [37, 75], cloud-based attacks [32, 76], attacks on and from trusted execution environments [10, 44, 61], attacks from mobile code [23, 46, 51], and new attack techniques [11, 28, 44].”
Packet Chasing: Spying on Network Packets over a Cache Side-Channel (2019, neutral): “In addition to PRIME+PROBE, multiple other variants of cache attacks are also proposed [25]–[27].”
Plundervolt: Software-based Fault Injection Attacks against Intel SGX (2020, background): “Hence, both the scientific community and industry have put significant effort in developing Rowhammer mitigations [41, 37, 27, 3, 23, 53, 12, 79, 13, 74, 22, 10].”