PaperlayerView exact revision on arXiv

Source-linked AI summary

Flush+Flush: A Fast and Stealthy Cache Attack

Daniel Gruss, Clémentine Maurice, Klaus Wagner, Stefan Mangard

arXiv:1511.04594v3cs.CR

TL;DR

Cache-attack detectors assume attacks generate elevated cache hits and misses, but the paper develops Flush+Flush to challenge that assumption. By inferring cache state from clflush timing without memory accesses, Flush+Flush avoids cache misses and reaches 496 KB/s, 6.7 times faster than previous cache covert channels.

  • Problem

    Existing detection mechanisms assume cache attacks produce significantly more cache hits and misses than benign applications.

  • Method

    Flush+Flush infers whether data is cached from clflush execution time without making memory accesses.

  • Results

    496 KB/s is achieved in a cross-core covert channel, 6.7 times faster than any previously published cache covert channel.

  • Takeaways & Limitations

    Flush+Flush is stealthy against cache-hit and cache-miss performance-counter detection and does not trigger prefetches.

  • Takeaways & Limitations

    Flush+Flush has slightly lower accuracy than Flush+Reload in some cases because cached and uncached timings differ less.

Abstract

from arXiv · show

Research on cache attacks has shown that CPU caches leak significant information. Proposed detection mechanisms assume that all cache attacks cause more cache hits and cache misses than benign applications and use hardware performance counters for detection. In this article, we show that this assumption does not hold by developing a novel attack technique: the Flush+Flush attack. The Flush+Flush attack only relies on the execution time of the flush instruction, which depends on whether data is cached or not. Flush+Flush does not make any memory accesses, contrary to any other cache attack. Thus, it causes no cache misses at all and the number of cache hits is reduced to a minimum due to the constant cache flushes. Therefore, Flush+Flush attacks are stealthy, i.e., the spy process cannot be detected based on cache hits and misses, or state-of-the-art detection mechanisms. The Flush+Flush attack runs in a higher frequency and thus is faster than any existing cache attack. With 496 KB/s in a cross-core covert channel it is 6.7 times faster than any previously published cache covert channel.

1 Introduction

The paper introduces Flush+Flush, a cache attack that measures clflush timing without memory accesses, challenging performance-counter detection assumptions. It is stealthier and faster than existing cache attacks.

  • Flush+Flush exploits the timing difference of clflush between cached and uncached data.The instruction evicts the corresponding data from all cache levels.
  • Unlike other cache attacks, Flush+Flush performs no memory accesses, causing no cache misses and only minimal cache hits.
  • Existing hardware-performance-counter detection is ineffective against Flush+Flush because its underlying cache-activity assumption fails.
  • The paper evaluates performance and detectability in covert-channel, user-input, and AES side-channel scenarios.
  • 496 KB/s is achieved in a cross-core covert channel, 6.7 times faster than any previously published cache covert channel.

2 Background

This section explains CPU-cache organization, shared memory, and timing-based cache attacks. It introduces Prime+Probe, Flush+Reload, and Rowhammer as relevant attack techniques and distinctions.

  • CPU caches reduce access time by buffering frequently used data in small, fast memories.
  • Modern Intel processors use private lower-level caches and a shared inclusive L3 cache across CPU cores.
  • The unprivileged clflush instruction evicts a cache line from the entire cache hierarchy.
  • Shared libraries, mapped files, forked processes, and deduplicated pages can create shared physical memory between processes.
  • Prime+Probe monitors victim-induced cache-set replacement, whereas Flush+Reload flushes and reloads a shared cache line to infer victim activity.
  • Rowhammer repeatedly accesses DRAM rows to induce bit flips while bypassing cache levels.

3 The Flush+Flush Attack

Flush+Flush measures clflush execution time on a targeted shared line to infer whether another process cached it. The approach is fast and stealthy but can be slightly less accurate than Flush+Reload.

  • Flush+Flush is faster and has fewer cache side effects than existing cache attacks, while operating across cores and in virtualized environments with suitable shared memory.
  • Flush+Flush performs a single repeated clflush phase and uses its execution time to determine whether a shared memory line is cached.
  • The attack does not load the target line, so it causes no cache misses and only a minimal number of cache hits.
  • Cached and non-cached clflush timings differ by 12 cycles on Sandy Bridge, 9 cycles on Ivy Bridge, and 12 cycles on Haswell.A remote-core cache hit adds another 3-cycle penalty.
  • Flush+Flush has slightly lower accuracy than Flush+Reload in some cases because cached-versus-uncached timing differences are smaller.Avoiding memory accesses also prevents prefetcher interference when monitoring multiple addresses within a physical page.

4 Detecting Cache Attacks with Hardware Performance Counters

The paper evaluates hardware-performance-counter detection of cache attacks using normalized cache events across benign workloads and attack scenarios. The selected mechanism detects conventional attacks but fails against Flush+Flush.

  • Hardware performance counters monitor events such as last-level-cache references and misses for performance analysis and attack detection.
  • Performance-counter detection fails against Flush+Flush because the attack causes no cache misses and minimal cache references.
  • The evaluation compares idle use, applications, benign high-load workloads, Flush+Reload, and Rowhammer over 135-second runs.
  • Processes are classified using cache-miss and cache-reference thresholds normalized by ITLB events.The reported thresholds are k_m = 2.35 and k_r = 2.34.
  • Four of 24 evaluated events detect both Flush+Reload and Rowhammer without false positives on benign applications.
  • Detection focuses on CACHE_MISSES and CACHE_REFERENCES after finding related L1D_RM and LL_RA events redundant.

5 Covert Channel Comparison

The study compares Flush+Flush, Flush+Reload, and Prime+Probe covert channels using a reproducible packet-based framework, evaluating capacity, error rate, and detectability. Flush+Flush provides the highest transmission rate while its receiver processes remain classified as benign.

  • Framework and implementations: The framework compares three covert-channel implementations under the same hardware, protocols, and reproducible experimental conditions.The channels are Flush+Flush, Flush+Reload, and Prime+Probe.
  • Framework and implementations: Each packet carries payload, sequence, and CRC-16 fields, with retransmission until acknowledgment and an effective error rate targeted below 5%.Transmission rate is computed from transmitted bits divided by runtime, while error rate compares sent and received bits.
  • Framework and implementations: Flush+Flush transmits a 1 by accessing shared memory before the receiver flushes it, whereas an idle sender represents 0.The receiver infers the bit from whether the shared line is present in the cache hierarchy.
  • Performance: 496 KB/s is the highest transmission rate among the three channels at a 28-byte packet size, with an effective error rate of 0.84%.Flush+Reload reaches 298 KB/s with an error rate below 0.005% at the same packet size.
  • Performance: 68 KB/s is the best Prime+Probe rate at a 5-byte packet size, compared with 132 KB/s for Flush+Reload and 95 KB/s for Flush+Flush.A 28-byte Prime+Probe packet would require 14 GB of memory for eviction sets and is therefore considered unrealistic.
  • Performance: Flush+Flush is 6.7 times faster than the fastest previously published cache covert channel and 7.3 times faster than the evaluated Prime+Probe channel.The 496 KB/s rate is reported at a comparable error rate to the prior fastest channel.
  • Detectability: All Flush+Flush receiver processes are classified as benign, while Prime+Probe is always detected and Flush+Reload is detected in all tested cases.Only the Flush+Flush and Flush+Reload senders using 4-byte packets are also classified as benign.
  • Detectability: Keeping only the receiver stealthy gives Flush+Flush a clear advantage, whereas making its sender stealthy is difficult because of cache hits.The sender performs better than the Prime+Probe sender but can exceed the detection threshold.

6 Side-Channel Attack on User Input

The paper evaluates Flush+Flush, Flush+Reload, and Prime+Probe for recovering keystroke timings and separately measures their detectability with cache performance counters. Flush+Flush is less accurate than Flush+Reload initially, but can exceed 92% accuracy while remaining far from detection.

  • Attack and accuracy: The keystroke attack monitors a GTK-library address and infers keystrokes from memory-access or clflush execution times.The program constantly flushes the monitored address while a user types.
  • Attack and accuracy: Flush+Reload correctly detects 96.1% of simulated keystrokes, while Flush+Flush correctly detects 74.7%.The evaluation simulates typing a 1000-character text, with each test lasting 135 seconds.
  • Detectability: Flush+Reload generates many cache references, whereas Flush+Flush generates a negligible number.Prime+Probe is omitted from the detectability table because it was not sufficiently accurate for the attack.
  • Detectability: Flush+Flush accuracy can exceed 92% while remaining far from detection by cache-reference and cache-miss performance counters.This makes it a viable stealthy alternative to Flush+Reload for the evaluated side channel.

7 Side-Channel Attack on AES with T-Tables

The AES side-channel comparison applies Flush+Flush, Flush+Reload, and Prime+Probe to recover key information from T-table accesses, evaluating accuracy, speed, and detectability. Flush+Flush needs more encryptions than Flush+Reload in the basic setup, but supports multi-address monitoring and avoids performance-counter detection.

  • Attack setup: The attack targets first-line T-table accesses during chosen-plaintext AES encryptions to infer upper key bits from cache behavior.The attacker repeats encryptions with selected and random plaintext bytes until one candidate consistently causes a cache hit.
  • Attack setup: Figure 3 compares cache templates produced by Flush+Reload, Flush+Flush, and Prime+Probe over the first T-table address range.All three templates use 1,000,000 encryptions, with k0 = 0x00.
  • Performance evaluation: 1.4 times as many encryptions are required by Flush+Flush as by Flush+Reload, but 13.7 times fewer than Prime+Probe for the same accuracy.The target is a 5% margin for correctly identifying the upper 4 bits of key byte k0.
  • Performance evaluation: 275 encryptions suffice with Flush+Flush monitoring multiple addresses, compared with 1.1 times as many for Flush+Reload and 17.5 times fewer than Prime+Probe.Flush+Flush avoids triggering the prefetcher, allowing multiple adjacent cache sets to be monitored and improving measurement accuracy.
  • Detectability: 163 seconds are required for Flush+Flush over 256 million encryptions, versus 215 seconds for Flush+Reload and 234 seconds for Prime+Probe.Flush+Flush is not detected by the implemented performance-counter classifier, whereas the other attacks exceed the detection threshold.

8 Discussion

The discussion shows that Flush+Flush timing can reveal cache-slice and CPU-core information while evading common performance-counter detection. It also identifies hardware changes and shared-memory requirements as important boundaries and countermeasures.

  • Using clflush to Detect Cores and Cache Slices: A longer remote-slice clflush reveals whether an address maps to a remote cache slice, enabling inference of the executing CPU core from physical-address mappings.The timing difference arises from the ring bus connecting remote slices, while clflush exposes it directly through the last-level cache.
  • Using clflush to Detect Cores and Cache Slices: Flush+Flush can detect colocation on the same CPU, core, or hyperthreading core even when cpuid is virtualized.The inferred core information can enhance cache attacks and Rowhammer, although determining a thread’s core from memory-access timing is more difficult.
  • Implications: Operating-system restrictions on CPU-core and physical-address information cannot restrict clflush, so their protective effect is lower than expected.These restrictions make efficient cache attacks harder but do not remove the timing primitive used by Flush+Flush.
  • Countermeasures: Making clflush constant-time would prevent Flush+Flush and leakage about cache slices and CPU cores.The proposed modification addresses timing differences of 3 cycles across slices and less than 12 cycles between cache-hit and cache-miss cases.
  • Countermeasures: Monitoring every load could theoretically detect Flush+Flush, but software monitoring is impractical because it would significantly degrade performance.A hardware alternative, informing loads, would require an instruction-set change.
  • Countermeasures: Flush+Reload and Flush+Flush require shared memory, whereas Prime+Probe can be used when shared memory is unavailable.Making clflush privileged would block both attacks but would require hardware changes unavailable on commodity systems.

9 Related work

Related work places Flush+Flush among cache attacks, covert channels, and defenses based on monitoring cache activity. The paper reimplements competing covert channels to compare them under the same hardware and protocol.

  • Detection: HomeAlone uses a Prime+Probe covert channel to detect hostile virtual machines that share a CPU.It monitors random cache sets while allowing friendly virtual machines to continue operating when workloads change.
  • Detection: Cache Template Attacks can detect attacks on shared libraries and binaries, but permanent scanning increases system load and covers only a small address range promptly.This limits their practical response scope.
  • Detection: Prior proposals monitor cache misses or traces of cache references and misses to detect Flush+Reload and Rowhammer attacks.The paper reports that its implemented detection mechanism works for previous attacks but not for Flush+Flush.
  • Countermeasures: Proposed defenses span hardware, system, and application levels, including secure caches, altered prefetcher policies, and page coloring.Hardware changes are described as inapplicable to commodity systems.
  • Covert channels: Prime+Probe and Flush+Reload were established bases for cache covert channels, but prior work had not studied Flush+Reload covert-channel performance.The paper addresses this by implementing all three techniques with the same protocol and hardware setup.
  • Keystroke side channels: Software side channels have been used to eavesdrop on user input through execution time, CPU/cache activity, and system services.The related work motivates the paper’s keystroke-timing scenario.

10 Conclusion

The paper concludes that Flush+Flush determines cache state from clflush timing without memory accesses, making it broadly applicable and difficult for cache-activity counters to detect. It reports higher speed than existing cache attacks and proposes constant-time clflush as a practical defense.

  • Conclusion: Flush+Flush determines whether data is cached using only the execution time of clflush and performs no memory accesses.It also does not trigger prefetches, extending applicability to situations where other attacks fail.
  • Conclusion: 496 KB/s is achieved in a cross-core covert channel, 6.7 times faster than any previous cache covert channel.The conclusion states that Flush+Flush is faster than existing cache attacks.
  • Conclusion: Performance-counter defenses fail because Flush+Flush causes no cache misses, contradicting their underlying assumption about cache activity.The attack is therefore significantly harder to detect than existing cache attacks.
  • Countermeasure: Constant-time clflush can prevent the attack with small hardware modifications and without measurable impact on current software or interface changes.The paper presents this as an effective countermeasure.
  • Implications: The experiments broaden understanding of modern CPU-cache internals and support both discovering and preventing cache attacks.This consequence is stated within the scope of the paper’s findings.
Loading 1511.04594v3…