PaperlayerView exact revision on arXiv

Source-linked AI summary

NetSpectre: Read Arbitrary Memory over Network

Michael Schwarz, Martin Schwarzl, Moritz Lipp, Daniel Gruss

arXiv:1807.10535v1cs.CR

TL;DR

NetSpectre addresses whether Spectre variant 1 can read memory remotely from devices that run no attacker-controlled code. It builds network-visible cache and AVX covert channels around exposed Spectre gadgets, achieving remote leakage and ASLR breaks while identifying unresolved gadget-detection and mitigation challenges.

  • Problem

    Earlier Spectre attacks required local code execution, leaving billions of devices without attacker-controlled code believed safe.

  • Method

    NetSpectre sends crafted requests to a network-exposed Spectre gadget and infers secret-dependent microarchitectural state from response timing using cache or AVX-based covert channels.

  • Results

    NetSpectre leaks 15 bits per hour with remote Thrash+Reload and 60 bits per hour over a local-area network with the AVX-based covert channel, with around 3 bits per hour in Google Cloud.

  • Takeaways & Limitations

    Remote Spectre exposes devices without attacker-controlled code and can use weaker gadgets to break ASLR remotely.

  • Takeaways & Limitations

    The paper reports no technique to identify all covert channels, leaving complete gadget identification unresolved.

Abstract

from arXiv · show

In this paper, we present NetSpectre, a generic remote Spectre variant 1 attack. For this purpose, we demonstrate the first access-driven remote Evict+Reload cache attack over network, leaking 15 bits per hour. Beyond retrofitting existing attacks to a network scenario, we also demonstrate the first Spectre attack which does not use a cache covert channel. Instead, we present a novel high-performance AVX-based covert channel that we use in our cache-free Spectre attack. We show that in particular remote Spectre attacks perform significantly better with the AVX-based covert channel, leaking 60 bits per hour from the target system. We verified that our NetSpectre attacks work in local-area networks as well as between virtual machines in the Google cloud. NetSpectre marks a paradigm shift from local attacks, to remote attacks, exposing a much wider range and larger number of devices to Spectre attacks. Spectre attacks now must also be considered on devices which do not run any potentially attacker-controlled code at all. We show that especially in this remote scenario, attacks based on weaker gadgets which do not leak actual data, are still very powerful to break address-space layout randomization remotely. Several of the Spectre gadgets we discuss are more versatile than anticipated. In particular, value-thresholding is a technique we devise, which leaks a secret value without the typical bit selection mechanisms. We outline challenges for future research on Spectre attacks and Spectre mitigations.

1 INTRODUCTION

NetSpectre extends Spectre variant 1 from local to remote attacks, requiring no attacker-controlled code on the target but a suitable exposed gadget. It introduces network-capable cache and AVX covert channels, demonstrates remote data leakage and ASLR breaks, and highlights broader gadget versatility and mitigation challenges.

  • Motivation: Spectre exploits speculative-execution side effects to leak secrets, but earlier demonstrations required local code execution.Variant 1 commonly abuses misspeculation after bounds checks through Spectre gadgets.
  • Remote attack: NetSpectre remotely reads arbitrary memory through crafted requests, response-time measurements, and a Spectre gadget exposed through a network interface or API.The attack requires no attacker-controlled code on the victim, but it does require a Spectre gadget in target code.
  • Remote covert channels: 15 bits per hour are leaked by the remote Thrash+Reload variant, which distinguishes cache hits and misses by averaging network-request latency.This is presented as the first access-driven remote cache attack over a network and retrofits existing Spectre attacks to the network setting.
  • Remote covert channels: 60 bits per hour are leaked over a local-area network using an AVX2 execution-time covert channel instead of a cache channel.The AVX-based channel achieves 125 bytes per second in native code at a 0.58% error rate; Google-cloud leakage is around 3 bits per hour between independent virtual machines.
  • Gadgets and implications: Remote attacks make weaker gadgets useful for breaking ASLR, while value-thresholding extracts secret values through comparisons without typical bit selection or memory-reference mechanics.Value-thresholding uses a divide-and-conquer approach similar to binary search.
  • Gadgets and implications: NetSpectre broadens the affected-device population to systems without untrusted code execution, requiring countermeasures for devices previously considered safe.The paper also proposes a clearer-structured alternative to Retpolines and outlines future Spectre and mitigation challenges.

2 BACKGROUND

The background explains how out-of-order and speculative execution create microarchitectural side effects, and how attackers observe those effects through side channels and covert channels. It situates Spectre among cache-based and remote timing attacks while motivating SIMD-based alternatives.

  • Speculative execution: Out-of-order processors execute instructions in parallel and may retain microarchitectural differences even when speculative results are discarded before retirement.The reorder buffer preserves architectural order, but transient operations can leave non-architectural effects.
  • Speculative execution: Branch prediction enables speculative execution along a predicted path, and Spectre manipulates it to induce secret-dependent accesses in a victim process.A Spectre gadget combines an operation such as a bounds check with a later operation producing a microarchitectural side effect.
  • Microarchitectural attacks: Microarchitectural attacks infer otherwise inaccessible information from timing or behavioral differences caused by processor elements and optimizations.Software-based side-channel attacks do not require physical access to the device.
  • Cache attacks: Cache attacks exploit latency differences from cache hierarchies, with techniques including Evict+Time, Prime+Probe, Flush+Reload, and Evict+Reload.Flush+Reload variants operate at cache-line granularity using shared memory and inclusive last-level caches.
  • Remote timing: Remote timing attacks previously exploited algorithm-dependent cache misses, whereas NetSpectre extends remote cache observation to Spectre-style leakage.The earlier literature includes remote attacks against weak AES implementations.
  • Microarchitectural attacks: Covert channels let an attacker control both the side-effect source and its measurement to transfer information across architectural security boundaries.Spectre and Meltdown use covert channels to transmit secrets, even though the attacks themselves are not classified as side-channel attacks.
  • SIMD channels: SIMD instructions process multiple data values in parallel and provide a processor-supported basis for alternative microarchitectural channels.The paper discusses SIMD extensions across Intel, AMD, and ARM processors and uses AVX-based timing as an alternative to cache covert channels.

3 ATTACK OVERVIEW

NetSpectre adapts Spectre variant 1 to remote packet-triggered execution, using leak and transmit gadgets to expose speculative microarchitectural effects over a network. Gadget placement determines whether the attack can reach application-specific secrets or broadly mapped system memory.

  • Attack overview: NetSpectre uses separate leak and transmit gadgets to perform Spectre attacks without attacker-controlled code or local access on the target.The gadgets may be reached through different independent interfaces, both of which must be accessible to the attacker.
  • Attack requirements: The attack requires a reachable network interface and many packets, while the packet contents need not themselves be attacker-controlled.NetSpectre trains in place by alternating valid and invalid values at the exposed interface.
  • Leak gadget: The attacker trains the branch predictor with in-bounds inputs, then sends an out-of-bounds input that speculatively accesses a secret location.The resulting cache-state change persists even though the architectural assignment is discarded.
  • Gadget location: Kernel-space gadgets can expose kernel and typically system memory, whereas user-space gadgets offer a larger attack surface but are limited to secrets processed by the application.User-space services include web servers, FTP servers, and SSH daemons; multi-user applications may contain secrets belonging to many users.
  • Transmit gadget: The transmit gadget exposes the leak-induced microarchitectural state through network response timing rather than through the returned architectural value.The attacker averages many measurements because the timing difference is only on the order of nanoseconds.

4 REMOTE MICROARCHITECTURAL COVERT CHANNELS

NetSpectre builds remote covert channels by reflecting microarchitectural state in network response timing. It combines a cache-based Thrash+Reload channel with a faster AVX2 timing channel that avoids cache eviction.

  • Remote Cache Covert Channel: Thrash+Reload remotely distinguishes cache hits and misses by measuring and averaging network request response times.It thrashes the victim’s entire last-level cache through a network-accessible interface before reloading the target variable.
  • Remote Cache Covert Channel: Network latency noise requires averaging a large number of packets to distinguish cache-state timing differences with acceptable confidence.The cache-induced response-time difference is in the nanosecond range, while network latency varies substantially.
  • Remote Cache Covert Channel: 4 bit per minute with an error rate of < 0.1 % is achieved by the remote cache covert channel on a local-area network.
  • Remote AVX-based Covert Channel: 366 cycles separate active and inactive AVX2 execution for a 256-bit instruction on an Intel i5-6200U.The measured averages are 210 cycles when active and 576 cycles when powered down; the difference exceeds the reported 160-cycle cache-hit/miss difference.
  • Remote AVX-based Covert Channel: The AVX2 covert channel resets automatically after at least 1 ms of inactivity, avoiding the cache channel’s explicit eviction requirement.The upper half of the AVX2 unit powers down automatically, so waiting resets the encoded state.
  • Remote AVX-based Covert Channel: 8 B/min with an error rate of <0.1 % is achieved remotely over a local-area network using the AVX-based channel.In a native local environment, the channel reaches 125 B/s with an error rate of 0.58 %.

5 ATTACK VARIANTS

NetSpectre uses Spectre variant 1 gadgets to encode secret bits or address information into microarchitectural state and expose that state through network timing. The attack requires repeated measurements because network latency fluctuates, while weaker gadgets can still defeat remote ASLR.

  • Attack Variants: NetSpectre extracts secret data bit-by-bit or defeats remote ASLR using Spectre variant 1 gadgets reachable through remote packet handling.The attack sends crafted requests and measures response times without requiring attacker-controlled code on the target.
  • Extracting Data from the Target System: The data-extraction pipeline mistrains the branch predictor, resets microarchitectural state, leaks one bit, and transmits the encoded state over the network.
  • Extracting Data from the Target System: Repeated execution of all four steps is required because network-latency variance introduces noise into the measurements.The required repetition count depends mainly on the latency distribution of the network connection.
  • Breaking ASLR: Weaker gadgets that reveal address information rather than actual data can still break ASLR in the remote-attack setting.The gadget speculatively caches a known memory location, and network timing reveals whether the access occurred.
  • Breaking ASLR: 30 b of Linux ASLR entropy can be searched by binary-searching offsets around a known vsyscall page when only one offset is valid.

6 EVALUATION

NetSpectre was evaluated on Intel laptops and desktops, ARM Cortex A75 hardware, and Google Cloud virtual machines. The attacks successfully distinguish leaked bits, but require many measurements and remain slow, with AVX improving throughput over cache channels.

  • Evaluation Setup: 100 000 measurements are required even on a local network to reduce noise enough to distinguish leaked bits.The measured local-network latency standard deviation was 15.6 µs, nearly 3 orders of magnitude larger than the target timing difference.
  • Desktop and Laptop Computers: The proof-of-concept clearly distinguishes ‘0’-bits from ‘1’-bits using one million measurements per bit and simple histogram thresholding.
  • ARM Devices: The attack also works on ARM Cortex A75 devices despite higher network-latency variance.The ARM evaluation used a wired network, and simple thresholding separated the two bit distributions.
  • Google Cloud: 20 000 000 measurements per bit suffice to distinguish bits and leak arbitrary bits between Google Cloud virtual machines.The measured latency standard deviation was 52.3 µs, and the evaluation verified successful leakage between two instances.
  • Performance: A byte is leaked in 30 min over the local network with the cache channel, versus 8 min using the AVX covert channel.
  • ASLR Performance: 2 h is the average time required to break ASLR remotely using the cache covert channel.
  • Performance: 8 h per byte with the cache channel and 3 h per byte with the AVX channel are measured between Google Cloud virtual machines.

7 CHALLENGES OF MITIGATING SPECTRE

The paper identifies five challenges for mitigating Spectre: defenses may miss versatile gadgets, fail to safeguard all vulnerable paths, and incur performance or security costs. Network-layer measures can reduce attack feasibility, but adaptive attackers and unresolved root causes limit confidence in current defenses.

  • State-of-the-art countermeasures: lfence barriers stop traditional Spectre gadgets but may not stop speculative code fetches or other pre-execution microarchitectural behaviors used by NetSpectre.The paper reports that lfences can block speculative execution while leaving effects such as AVX-unit activation, instruction-cache fills, and TLB fills.
  • Network-layer countermeasures: Network monitoring and added latency noise may mitigate NetSpectre in practice, but attackers can adapt their rate and future thresholds may become ineffective.Reducing packet rates can evade DDoS or intrusion-detection thresholds, while higher latency variance increases the measurements required.
  • Future research challenges: Current mitigations address symptoms rather than the root performance-security trade-off, motivating five challenges for future Spectre research and mitigation.The paper also notes that blacklists are inherently incomplete and security mechanisms can have unwanted side effects.
  • Future research challenges: Spectre gadgets are more versatile than anticipated, including ASLR-breaking and AVX-based gadgets, while no technique currently identifies all covert channels.Gadgets can also distribute secret values across multiple code fragments before leakage occurs.
  • Future research challenges: Automatically identifying and safeguarding every Spectre gadget remains difficult because static analysis can miss scattered gadgets, while dynamic analysis is incomplete.Compiler-generated gadgets may also be invisible in source code, undermining protections applied during compilation.
  • Future research challenges: In-place mistraining is harder to mitigate than cross-process or cross-privilege mistraining, and proposed barriers still impose significant performance costs.The paper proposes barriers at possible indirect-call targets, but whether same-process Spectre can be fully prevented without high overhead or new problems remains unclear.

8 CONCLUSION

NetSpectre is the first remote Spectre variant 1 attack, extending Spectre to systems without attacker-controlled code through network requests and response-time measurements. It demonstrates remote cache and cache-free covert channels, reaching 15 and 60 bits per hour respectively, and was verified in local networks and the Google cloud.

  • 8 CONCLUSION: 15 bits per hour: NetSpectre demonstrates the first access-driven remote Evict+Reload cache attack over a network.The remote cache attack is called Thrash+Reload in the paper.
  • 8 CONCLUSION: 60 bits per hour: the AVX-based covert channel enables substantially higher NetSpectre leakage than the remote cache covert channel.This is also the first Spectre attack described in the paper that does not use a cache covert channel.
  • 8 CONCLUSION: NetSpectre was verified in local networks and between virtual machines in the Google cloud.
  • 8 CONCLUSION: Remote Spectre attacks expand exposure to devices without attacker-controlled code and can defeat address-space layout randomization remotely.The conclusion characterizes this as a shift from local to remote Spectre attacks.
  • 8 CONCLUSION: The paper concludes that remote Spectre attacks leave open challenges for future Spectre attacks and mitigations.
Loading 1807.10535v1…