PaperlayerView exact revision on arXiv

Source-linked AI summary

A Systematic Evaluation of Transient Execution Attacks and Defenses

Claudio Canella, Jo Van Bulck, Michael Schwarz, Moritz Lipp, Benjamin von Berg, Philipp Ortner, Frank Piessens, Dmitry Evtyushkin, Daniel Gruss

arXiv:1811.05441v3cs.CR

TL;DR

Transient execution attacks leave microarchitectural traces despite discarded architectural effects, while the completeness of defenses remains limited. The paper systematizes these attacks and defenses, demonstrates overlooked variants across Intel, AMD, and ARM, and finds that most defenses do not fully mitigate all variants.

  • Problem

    Existing transient-execution research provides limited insight into residual attack surface and whether proposed defenses are complete.

  • Method

    The paper builds a systematic attack taxonomy, evaluates variants with proofs of concept across Intel, ARM, and AMD, and systematically assesses defenses.

  • Results

    The systematization uncovers six previously overlooked attacks and shows that most defenses, including deployed ones, cannot fully mitigate all attack variants.

  • Takeaways & Limitations

    Transient-execution defenses should address entire attack types and variants, including those that remain unknown or overlooked.

  • Takeaways & Limitations

    The paper's real-world gadget-prevalence analysis is limited because platform-specific gadgets vary and transient execution distance can only be estimated from high-level code.

Abstract

from arXiv · show

Research on transient execution attacks including Spectre and Meltdown showed that exception or branch misprediction events might leave secret-dependent traces in the CPU's microarchitectural state. This observation led to a proliferation of new Spectre and Meltdown attack variants and even more ad-hoc defenses (e.g., microcode and software patches). Both the industry and academia are now focusing on finding effective defenses for known issues. However, we only have limited insight on residual attack surface and the completeness of the proposed defenses. In this paper, we present a systematization of transient execution attacks. Our systematization uncovers 6 (new) transient execution attacks that have been overlooked and not been investigated so far: 2 new exploitable Meltdown effects: Meltdown-PK (Protection Key Bypass) on Intel, and Meltdown-BND (Bounds Check Bypass) on Intel and AMD; and 4 new Spectre mistraining strategies. We evaluate the attacks in our classification tree through proof-of-concept implementations on 3 major CPU vendors (Intel, AMD, ARM). Our systematization yields a more complete picture of the attack surface and allows for a more systematic evaluation of defenses. Through this systematic evaluation, we discover that most defenses, including deployed ones, cannot fully mitigate all attack variants.

1 Introduction

Modern CPUs use prediction and out-of-order execution to keep pipelines full, but flushed transient instructions can leave microarchitectural traces. This proliferation complicates attack classification and defense, motivating a systematic taxonomy and evaluation that reveals overlooked attacks and incomplete mitigations.

  • Motivation: Modern CPUs predict control flow, data dependencies, and sometimes data, executing instructions ahead of time or out of order to keep pipelines full.Mispredictions and faults can require pipeline flushes that discard architectural effects.
  • Motivation: Transient instructions vanish architecturally after pipeline flushes, but their microarchitectural side effects can encode secrets recoverable by attackers.Cache state is one example of a residual microarchitectural trace.
  • Motivation: Confusing attack names and misconceptions about defenses make it difficult to understand transient execution variants and their implications.Some defenses target individual covert channels or rely on CPU features not yet evaluated for transient security.
  • Contributions: The paper introduces a decision-tree systematization that classifies transient attacks with an unambiguous naming scheme and exposes residual attack surface.The taxonomy is hierarchical and extensible.
  • Contributions: Six previously overlooked attacks are identified: Meltdown-BND, Meltdown-PK, and four Spectre mistraining strategies.Meltdown-BND affects Intel and AMD, while Meltdown-PK affects Intel.
  • Contributions: Systematic defense evaluation shows that most defenses, including deployed ones, cannot fully mitigate all attack variants.The authors also report attacks that remain mountable despite rolled-out patches.

2 Transient Execution

Transient execution attacks exploit discarded computations whose microarchitectural traces remain observable. The paper organizes these attacks around their execution flow and distinguishes Spectre's prediction-based mechanism from Meltdown's fault-related data forwarding.

  • Foundations: The instruction set architecture defines the hardware-software interface, while microarchitecture implements it through pipelines, caches, execution units, and branch prediction.Architectural state is observable by developers; microarchitectural state includes internal processor state.
  • Transient Execution: Transient instructions are unauthorized computations whose results are not committed architecturally but may leave traces that reveal unauthorized results.These traces enable recovery through side-channel or covert-channel observations.
  • Attack Flow: A transient attack prepares microarchitectural state, triggers a fault or misprediction, encodes data through a covert channel, and reconstructs the secret after flushing.Secret-dependent cache loads and timing measurements are representative encoding and recovery steps.
  • Spectre vs. Meltdown: Spectre relies on control- or data-flow prediction, whereas Meltdown exploits forwarding of data from a faulting instruction to later pipeline instructions.The two attack classes therefore require orthogonal defenses.
  • Spectre Taxonomy: Table 1 maps Spectre-type attacks to microarchitectural elements they exploit, partially target, or do not affect.The table organizes variants by their microarchitectural root cause.

3 Spectre-type Attacks

The paper classifies Spectre attacks by the microarchitectural buffer triggering misprediction and by how attackers mistrain that predictor. This systematization exposes overlooked strategies across PHT, BTB, and RSB attacks, including strategies that broaden attacks against restricted victims.

  • Taxonomy: Spectre attacks are categorized by their triggering microarchitectural element and by the mistraining strategy used to steer prediction.The first level covers PHT, BTB, RSB, and STL mechanisms; the second distinguishes in-place, out-of-place, same-address-space, and cross-address-space poisoning.
  • Mistraining strategies: The four mistraining strategies combine victim or attacker-controlled processes with the vulnerable branch or a congruent branch.They are same-address-space in-place, same-address-space out-of-place, cross-address-space in-place, and cross-address-space out-of-place.
  • Spectre-PHT: Intel, ARM, and AMD CPUs tested were vulnerable to all four Spectre-PHT mistraining strategies.This was the first successful demonstration of Spectre-PHT-style branch-misprediction attacks without prior execution of the victim branch.
  • Spectre-PHT: Cross-address-space and out-of-place PHT poisoning can train predictors outside a victim enclave or daemon process.For SGX, training can occur in an untrusted host process through a congruent branch on the same physical core.
  • Spectre-BTB and Spectre-RSB: The evaluation reproduced known BTB strategies, found no out-of-place BTB poisoning on AMD or ARM, and generalized four RSB strategies to AMD.On ARM, RSB poisoning succeeded within the same address space but showed no cross-address-space leakage, possibly due to proof-of-concept limitations.
  • Spectre-BTB: Same-address-space in-place BTB poisoning uses the victim’s repeated valid indirect-branch executions and may bypass BTB flushing or partitioning mitigations.Because the victim determines the branch destination, this strategy lacks arbitrary transient control-flow redirection but may enable speculative type confusion.

4 Meltdown-type Attacks

Meltdown-type attacks exploit transient execution after CPU exceptions, unlike Spectre attacks, which exploit branch misprediction. The paper classifies these attacks by exception type, page-table protection bits, reachable storage, and privilege boundaries, revealing previously unknown exploitable variants.

  • Attack model: Meltdown-type attacks rely on transient instructions following CPU exceptions, whereas Spectre-type attacks use branch misprediction to trigger transient execution.Exceptions become architecturally visible only when the faulting instruction retires, allowing subsequent transient instructions to execute first.
  • Classification: The classification organizes Meltdown attacks by triggering exception, page-table protection bits, reachable storage locations, and privilege-boundary crossing.The first level uses faults, traps, and aborts; page faults receive further categorization by page-table entry protection bits.
  • Findings: The systematization discovered several previously unknown Meltdown variants, including two exploitable effects.It also provided the first demonstration of exploitable Meltdown-type delayed exception-handling effects on AMD CPUs.
  • Meltdown-US: Original Meltdown reads kernel memory from user space by transiently forwarding unauthorized data into a cache-based covert channel before the page fault becomes visible.The attacker reconstructs the privileged data after the exception through channels such as Flush+Reload.
  • Meltdown-US: Suppressing or handling exceptions enables byte-wise dumping of the entire kernel, potentially including all physical memory exposed through a direct physical map.Relevant techniques include Intel TSX, exception handling, and hiding the exception within another transient execution.

4.2 Meltdown-P (Virtual Translation Bypass)

Meltdown-P exploits terminal faults during virtual-address translation. Its variants target SGX enclaves, operating-system or hypervisor isolation, and even host data across virtual machines through erroneous L1 cache access.

  • Foreshadow: Foreshadow targets Intel SGX by clearing the enclave secret’s present bit so unauthorized access produces a terminal fault rather than a silent dummy value.The altered page-table entry enables a Meltdown-style transient access against enclave memory.
  • Mechanism: A terminal fault aborts address translation early while the L1 data cache can still receive the page-table entry’s physical frame number.This parallel indexing of L1 with address translation underlies Foreshadow-style leakage.
  • Foreshadow: SGX’s secure page swapping can prefetch arbitrary enclave pages, including interrupted CPU registers, into L1 for Meltdown-P leakage.The privileged adversary model therefore amplifies the transient-execution attack surface.
  • Foreshadow-NG: Foreshadow-NG generalizes the attack to operating-system and hypervisor isolation when an adversary controls or influences page-table physical frame numbers.Swap metadata can occupy page-table fields other than the present bit, potentially creating exploitable physical-address values.
  • Foreshadow-VMM: Foreshadow-VMM lets an untrusted virtual machine extract the host’s entire L1 data cache, including hypervisor and other-VM data.The cause is erroneous forwarding of guest-physical addresses to L1 before proper host-physical translation.

4.3 Meltdown-GP (System Register Bypass)

Meltdown-GP leaks privileged system-register data after an unauthorized register access raises a general-protection fault. Its lazy FPU-state-switch variant similarly exploits transient execution before a device-not-available exception retires.

  • Meltdown-GP: Meltdown-GP reads privileged system registers after unauthorized instructions such as rdmsr raise a general-protection fault.The attack relies on transient execution continuing after the faulting instruction but before the exception becomes architecturally visible.
  • Lazy state switching: Lazy FPU state switching marks the FPU unavailable instead of saving large FPU and SIMD registers during every context switch.The first subsequent FPU instruction triggers a device-not-available exception, allowing the operating system to save the state.
  • Lazy state switching: An attacker can exploit the #NM exception after a victim loaded data into FPU registers, because following instructions may execute transiently before the fault retires.The attack first lets the victim populate FPU registers, then switches to the attacker and issues an FPU instruction while the unit is marked unavailable.

4.5 Meltdown-RW (Read-only Bypass)

Meltdown-RW bypasses read-only protections within the attacker’s current privilege level because transient execution ignores the page-table read/write attribute. The attack was misnamed as Spectre Variant 1.2, but its root cause is a page fault.

  • Meltdown-RW transiently overwrites read-only data within the current privilege level, potentially bypassing software sandboxes relying on hardware-enforced read-only memory.
  • The attack was originally called Spectre Variant 1.2, although its transient cause is a #PF exception rather than branch prediction.
  • Meltdown-PK bypasses both read and write isolation provided by Intel’s user-space protection keys.A proof of concept leaked protected data through a Flush+Reload covert channel after accesses generated a #PF.

4.7 Meltdown-BR (Bounds Check Bypass)

Meltdown-BR exploits delayed handling of bounds-check exceptions rather than predictor mistraining. Proofs of concept demonstrated out-of-bounds leakage through both IA32 bound protection and Intel MPX.

  • Table 5 summarizes which CPU vendors are vulnerable to the evaluated Meltdown attacks, with symbols distinguishing vulnerable and non-vulnerable models.The tests summarized there were performed without defenses enabled.
  • Meltdown-BR exploits transient execution after a #BR exception to encode out-of-bounds secrets that never become architecturally visible.
  • The Spectre-type classification is misleading because no prediction is involved; the attack exploits lazy handling of the raised exception.
  • Proofs of concept demonstrated leakage through IA32 bound protection on Intel and AMD, and through MPX protection on Intel.

4.8 Residual Meltdown (Negative Results)

The evaluation found no leakage for several tested exceptions and hypothesized that Meltdown may require faults, while acknowledging that failed experiments cannot exclude other possibilities.

  • Experiments consistently found no transient-execution traces beyond traps or aborts, leading to the hypothesis that Meltdown requires faults.The authors caution that failed experiments might still have missed possible effects.
  • Divide-by-zero experiments on tested Intel and AMD CPUs continued transient execution but leaked no real values because the result register was set to 0.
  • Experiments showed no data leakage for SMAP access, alignment faults, or out-of-limit segment accesses.The authors attribute these negative results to early validation or exception handling before the offending access reaches transient execution.

5 Gadget Analysis and Classification

The paper classifies transient attacks by microarchitectural cause and gadget execution phase, then examines gadget prevalence and exploitability in real-world software. This framework exposes many ordinary bounds-check gadgets but fewer highly dangerous gadgets, while practical analysis remains difficult across platforms and processor designs.

  • Gadget Analysis and Classification: The attack tree abstracts from covert channels and code gadgets, classifying attacks by the microarchitectural root cause of transient computation.
  • 5.1 Gadget Classification: A gadget is a series of instructions executed by the attacker or victim, assigned to an abstract attack phase according to its execution phase and objective.
  • 5.1 Gadget Classification: Gadget choice depends largely on attacker capabilities, enabling different gadget compositions to represent a broad spectrum of adversary models.
  • 5.1 Gadget Classification: The analysis distinguishes Prefetch, Compare, Index, and Execute gadgets, with later types supporting branching, indexed leakage, or arbitrary transient code execution.
  • 5.2 Real-World Software Gadget Prevalence: Spectre-type attacks remain difficult to demonstrate in real-world software because exploitable gadgets are harder to find outside controlled environments.
  • 5.2 Real-World Software Gadget Prevalence: Smatch reported 736 gadget candidates in April 2018, while the Linux kernel had about 15 Spectre-PHT-resistant array indices, illustrating a high false-positive burden.
  • 5.2 Real-World Software Gadget Prevalence: Linux Spectre-PHT patches increased continuously over the examined year, making automated detection and gadget classification ongoing research challenges.
  • 5.2 Real-World Software Gadget Prevalence: The analysis found more gadgets than array_index_nospec occurrences because multiple arrays and branches can reuse the same masked index or loaded value.More dangerous gadgets enabling over-1-bit leakage or arbitrary code execution were not frequently occurring.

6 Defenses

The paper classifies Spectre and Meltdown defenses by how they stop leakage, speculation, or secret access, then evaluates their coverage and residual weaknesses. The evaluation finds that several deployed or proposed defenses remain partial, channel-specific, hardware-dependent, or bypassable.

  • Defense classification: Defenses are classified by whether they reduce covert-channel accuracy, mitigate speculation, or prevent secret data from being reached.Meltdown defenses are additionally categorized by preserving architectural inaccessibility or preventing faults.
  • Hardware defenses: InvisiSpec buffers transient loads outside the cache hierarchy, invalidating them after incorrect predictions and committing them after correct predictions.The method also compares the loaded value with the most recent value for data coherency.
  • Defense mechanisms: Spectre defenses include cache partitioning, transient-data taint tracking, reduced timer accuracy, network noise, and controls such as IBRS, STIBP, IBPB, SSBB, SSBS, and SSBD.These measures target covert channels, prediction mechanisms, or speculative load-store bypasses through different hardware and software mechanisms.
  • Software defenses: SLH introduces compiler-level data dependencies that zero speculative pointers after misspeculation, preventing speculative loads from leaking data.The approach requires hardware support for the relevant behavior.
  • Defense limitations: Several defenses target only one covert channel, limit leakage, require more repetitions, protect only cross-process attacks, or depend on hardware and operating-system support.The paper therefore characterizes them as unreliable or partial solutions rather than complete mitigations.
  • Evaluation results: On patched systems, the authors executed Meltdown-BND on Ryzen and Meltdown-MPX, Meltdown-BND, Meltdown-RW, and Meltdown-PK on several Intel systems.The results indicate that current mitigations prevent Meltdown-type attacks crossing the current privilege level, but not all tested attacks.
  • Performance impact: Serialization can substantially reduce performance, whereas KPTI's decrease is almost negligible on systems supporting PCID.Reported countermeasure costs are difficult to compare because studies use different scenarios and some require unavailable hardware changes.

7 Future Work and Conclusion

The paper identifies unresolved questions about where Meltdown data leaks from and how prevalent exploitable gadgets are in real-world software. It concludes that future defenses should target root causes and account for attack variants that have not yet been discovered.

  • Future Work: Future work should test whether additional Meltdown-type attacks can leak data from microarchitectural buffers beyond the L1 data cache and main memory.The paper notes that Meltdown-US can also leak from explicitly uncacheable locations served by the Line Fill Buffer.
  • Future Work: The authors call for automated gadget detection and broader analysis of gadget prevalence in real-world software.Their current evaluation of gadget prevalence was small.
  • Conclusion: The systematic defense evaluation found that some attacks bypass rolled-out patches while others remain unmitigated because they were overlooked.The authors encourage using the taxonomy to discover new variants and develop root-cause mitigations.
Loading 1811.05441v3…