Source-linked AI summary
SMoTherSpectre: exploiting speculative execution through port contention
Atri Bhattacharyya, Alexandra Sandulescu, Matthias Neugschwandtner, Alessandro Sorniotti, Babak Falsafi, Mathias Payer, Anil Kurmus
TL;DR
The paper asks whether speculative attacks can affect generic user-space applications without attacker-provided code and whether they require cache-based channels. It introduces SMoTherSpectre, which uses port contention during speculative code reuse and automated gadget discovery, and demonstrates leakage-oriented proof-of-concept attacks against OpenSSH and OpenSSL.
Problem
It was unclear whether speculative attacks could leak from applications that do not load attacker-provided code and whether cache-based side channels were necessary.
Method
SMoTherSpectre combines branch target injection, port-contention measurements on SMT processors, and automated discovery of SMoTher-gadgets in existing binaries.
Results
The paper finds hundreds of usable glibc gadgets and demonstrates proof-of-concept leakage attacks against OpenSSH host-key bits and an OpenSSL encryption application.
Takeaways & Limitations
Port-contention side channels can support speculative code-reuse attacks, so defenses limited to cache channels or post-speculation state reversal are insufficient in SMT environments.
Takeaways & Limitations
The gadget search under-approximates usable gadgets because preceding computations can change which secret bits a discovered sequence leaks.
Abstract
from arXiv · showhide
Spectre, Meltdown, and related attacks have demonstrated that kernels, hypervisors, trusted execution environments, and browsers are prone to information disclosure through micro-architectural weaknesses. However, it remains unclear as to what extent other applications, in particular those that do not load attacker-provided code, may be impacted. It also remains unclear as to what extent these attacks are reliant on cache-based side channels. We introduce SMoTherSpectre, a speculative code-reuse attack that leverages port-contention in simultaneously multi-threaded processors (SMoTher) as a side channel to leak information from a victim process. SMoTher is a fine-grained side channel that detects contention based on a single victim instruction. To discover real-world gadgets, we describe a methodology and build a tool that locates SMoTher-gadgets in popular libraries. In an evaluation on glibc, we found hundreds of gadgets that can be used to leak information. Finally, we demonstrate proof-of-concept attacks against the OpenSSH server, creating oracles for determining four host key bits, and against an application performing encryption using the OpenSSL library, creating an oracle which can differentiate a bit of the plaintext through gadgets in libcrypto and glibc.
1 INTRODUCTION
Earlier speculative-execution attacks primarily used cache-based side channels and often depended on attacker-provided code or specific victim gadgets. SMoTherSpectre shows that port contention enables speculative code-reuse attacks against generic user-space programs, with automated gadget discovery and real-world targets.
- Spectre and Meltdown leave microarchitectural traces that can leak data from a target address space through memory-architecture side channels.
- Earlier side-channel attacks generally targeted data-dependent control flow or memory accesses, such as cache eviction patterns that reveal addresses.
- Existing attacks were predominantly cache-based, often requiring specific victim gadgets; the initial Spectre v2 attack instead redirected speculation to attacker-provided eBPF code.
- SMoTherSpectre uses branch target injection on existing program code, combining speculative execution with port contention rather than a memory-based side channel.
- The paper characterizes SMoTher, develops an automated gadget-finding technique, and demonstrates attacks against OpenSSH and current OpenSSL code.
- Port sharing was previously shown to leak code access patterns, whereas this work characterizes the channel for speculative attacks and reports proof-of-concept leakage from up-to-date OpenSSL and OpenSSH host-key bits.
2 BACKGROUND
The background explains how out-of-order, speculative, and simultaneously multithreaded processors share execution resources. These shared resources, especially execution ports and branch-prediction structures, create the microarchitectural conditions exploited by speculative attacks.
- Modern CPUs use a frontend to predict and fetch instructions, while the backend schedules decoded operations for execution.
- Decoded µops enter an instruction window and may execute out of order when operands and specialized execution units are available.
- Execution units share ports, and contention for a port delays execution; Figure 1 illustrates per-cycle scheduling limits for shared ports.
- Speculative execution runs predicted µops before branch outcomes are certain, with a reorder buffer committing completed state in program order.
- Simultaneous multithreading lets µops from multiple threads execute on one core while sharing execution units and other microarchitectural structures.
- Speculative attacks can prime shared branch-prediction structures, while cache-timing attacks infer discarded speculative effects from memory regions brought into the cache.
3 SMOTHER
SMoTher uses contention on shared execution ports between co-located SMT threads as a measurable side channel. Experiments show that timing short victim instruction sequences can distinguish their execution, although synchronization and other hardware effects constrain measurements.
- SMoTher side channel: SMoTher exploits shared execution ports between co-located SMT threads: instructions using the same port contend for resources and alter attacker timing.The attacker can detect whether a victim executes an instruction on a given port.
- 3.1 Experimental characterization: In the controlled experiment, port contention made execution take about twice as long as the non-contended case.The experiment used 1,200 shl instructions on port 06 versus popcnt instructions on port 1, averaging 10,000 runs with 95%-confidence intervals.
- SMoTher-differentiability: SMoTher-differentiability means an attacker can infer which sequence from a victim set ran using timing measurements and a statistical decision rule.The evaluation uses attacker timing distributions and Student’s t-test to establish differences with at least 95%-confidence.
- 3.2 Characterization of the side channel: 83% of plotted combinations showed significant timing differences between victim sequences of popcnt and ror.The measurements indicate that timing short instruction sequences is feasible for a vast majority of tested sequence-length combinations.
- 3.2 Characterization of the side channel: 48% of one-instruction, 83% of four-instruction, and 100% of 32-instruction popcnt measurements were SMoTher-differentiable.Measured differences ranged from close to 0% to 40%; longer victim sequences generally produced larger differences and lower variability.
- 3.2 Characterization of the side channel: The optimal attacker sequence increased from 10 instructions for one victim instruction to 45 for 32 victim instructions.For multiport victim instructions, variance was higher and selecting the attacker length became more important; practical measurements also require precise synchronization and avoiding other bottlenecks.
4 SMOTHERSPECTRE
SMoTherSpectre combines branch target injection with port-contention timing to leak secrets through existing victim code, without relying on cache-based side channels or injected attacker code. The paper characterizes usable gadgets and demonstrates leakage across processors and real-world libraries.
- Attack design: SMoTherSpectre poisons an indirect branch to speculatively execute a victim’s data-dependent conditional jump, then infers its outcome by timing port contention.The attack reuses a BTI gadget that exposes secret data and a SMoTher gadget with distinguishable target and fall-through paths.
- Gadget availability: More than 12,000 readily usable gadgets exist in OpenSSL’s libcrypto, while common-library gadgets include comparisons that reveal sign, equality, constants, and selected bits.The authors report approximately 350 cmp-zero gadgets, around 100 sign-testing gadgets, 294 comparisons against one, and 807 comparisons against other constants.
- Novelty: The attack does not require confidential-data-dependent control flow in the victim because the secret-loading BTI gadget and speculative SMoTher gadget can be independent.This separates secret disclosure from the vulnerable control-flow pattern traditionally sought in cryptographic code.
- Side-channel characterization: 98%+ accuracy was achieved when recovering 20,000 secret bits using five samples, at 24,000 bit/s and 120,000 samples/second.Using one through four samples reduced accuracy to 72%, 78%, 83%, and 90%, demonstrating an accuracy–leakage-rate trade-off.
- Cross-platform evaluation: On Haswell, five samples yielded 76% accuracy, with lower accuracies for one through four samples; the attack was also validated on Broadwell.Haswell accuracies were 53%, 62%, 69%, 70%, and 76% for one through five samples, respectively.
- Leakage composition: Chaining gadgets across victim-loop iterations can leak multiple bits from a stable register or memory value; one example chain leaks 21 bits from rax.Different SMoTher gadgets can be targeted on successive iterations while the secret state remains unchanged.
5 GADGET DISCOVERY
The paper identifies and ranks SMoTher-gadgets by pairing BTI and SMoTher gadget properties, port utilization, branch structure, and memory-operation noise. It then automates discovery in common libraries, finding usable gadgets in glibc while acknowledging that the search under-approximates the full gadget space.
- Gadget structure: SMoTherSpectre requires a BTI gadget that passes a secret through a register and a SMoTher gadget that compares that register before conditional control flow.The BTI gadget supplies the secret to an arbitrary speculative target, while the SMoTher gadget receives and tests it.
- Ranking SMoTher-gadgets: Port fingerprinting summarizes instruction-sequence port utilization and enables ranking gadget pairs by their utilization differences.IACA produces a port fingerprint listing total cycles spent on each processor port; OSACA provides an open-source alternative supporting AMD processors.
- Ranking SMoTher-gadgets: The ranking combines port-utilization difference with branch-length similarity and inverse memory-operation cost to prioritize detectable, low-noise gadgets.The final rank uses the geometric mean of the three ranking factors, with k = 3 properties.
- Finding Gadgets: The discovery tool scans common system libraries for valid instruction sequences, considering branch lengths from 3 to 70 instructions and registers used by the x86_64 calling convention.It searches from every binary offset and focuses on gadgets that use calling-convention registers directly or through pointees.
- Finding Gadgets: The search finds enough SMoTher-gadgets in glibc alone to support attacks, including gadgets that compare register values or values addressed through those registers.Table 3 reports gadgets for registers used to pass arguments under the System V x86_64 calling convention, distinguishing direct register use from pointee use.
- Finding Gadgets: The search under-approximates usable gadgets because it starts each gadget at the latest flag-setting instruction before the jump, potentially missing preceding computations that change the leaked bit.For example, preceding shifts can make the full sequence leak a different bit than the shorter sequence identified by the tool.
6 REAL WORLD ATTACK
The paper demonstrates SMoTherSpectre attacks against OpenSSH and OpenSSL using speculative gadgets and port contention rather than cache-based leakage. The OpenSSH attack leaks host-key bits, while the OpenSSL experiment distinguishes secret-bit values through timing.
- OpenSSH attack: Leaking a small fraction of host-key bits can enable recovery of the entire key, according to the cited prior result.The attack uses a default OpenSSH 7.2 server binary on Ubuntu 16.04 LTS.
- OpenSSH attack: The OpenSSH threat model assumes a local attacker who can initiate TCP connections, with ASLR disabled or bypassed; a colocated VM is also considered.The proof of concept uses attacker and server processes on colocated logical cores.
- OpenSSH attack: OpenSSH attacks combine an indirect-call BTI gadget in explicit_bzero with SMoTher gadgets from glibc to target private host-key data.The BTI gadget is reached during connection handling, and the attacker can initiate repeated connections.
- OpenSSH attack: Four SMoTher gadgets leak bits at the 4th LSBs of bytes 13 and 14 and the 5th LSB of byte 56, in addition to the initial target bit.The corresponding assembly listings are provided in Appendix C.2.
- OpenSSL attack: OpenSSL targeting uses a libcrypto BTI gadget and a glibc SMoTher gadget during block encryption or decryption.The targeted indirect calls arise from common function-pointer coding practices and need not perform secret-dependent actions.
- Experimental results: A 10.69% ± 6.31% timing difference separates secret-bit conditions with 95% confidence in the OpenSSH experiment.The distributions show the zero-secret condition tending toward higher attacker timing values.
7 RELATED WORK
Related work established transient-execution and cache side channels, while other studies examined shared execution resources. SMoTherSpectre extends this line by characterizing port contention and using it in a speculative attack.
- Transient Execution Attacks: Transient-execution attacks include speculative and out-of-order instructions that execute without necessarily retiring.Spectre and Meltdown are prominent examples of this class.
- Cache Side Channels: Cache side channels infer victim activity from timing differences between cached and uncached data or instructions.Evict-and-time, prime-and-probe, and flush-and-reload are described as cache-based techniques.
- Cache Side Channels: Prime-and-abort detects cache eviction through transactional-memory aborts rather than timing a probe operation.The attacker’s transaction occupies limited cache-buffering space and aborts when the victim accesses a critical address.
- Other Side Channels: Researchers have explored non-cache side channels based on TLB behavior, AVX-unit power states, and shared execution units.These studies include TLBleed, Netspectre-AVX, and earlier SMT execution-unit channels.
- Other Side Channels: Portsmash showed that port sharing can leak code-access patterns and secrets from a vulnerable OpenSSL version.The paper distinguishes its contribution by characterizing the channel and applying it to speculative execution against up-to-date OpenSSL.
8 CONCLUSION
The conclusion shows that BTI attacks can target applications without attacker-provided code by combining speculative control-flow hijacking, port contention, and automatically found gadgets. It argues that cache-only defenses are insufficient in SMT environments.
- Conclusion: BTI attacks against applications that do not load attacker-provided code are feasible for OpenSSH and OpenSSL encryption.The attacks use port contention as a non-cache-based side channel and a gadget-finding tool.
- Conclusion: SMoTherSpectre combines a precise port-contention characterization, speculative BTI exploitation, automated gadget discovery, and real-world attacks.The demonstrated targets include OpenSSH, OpenSSL, and libc.
- Conclusion: In SMT environments, defenses focused solely on cache side channels or speculative-state rollback are insufficient.This conclusion follows from the demonstrated non-cache-based leakage mechanism.
- Conclusion: Existing BTI mitigations are sufficient to prevent SMoTherSpectre immediately, while lower-overhead hardware defenses remain future work.The paper suggests side-channel-resistant thread-level parallelism as one possible direction.
A GADGETS LEAKING 21 BITS OF RAX
The appendix lists SMoTher-gadget fragments that compare values in rax against constants to leak 21 bits, with gadgets identified across several libraries.
- Gadget inventory: 21 bits of information from rax are represented by SMoTher-gadget parts and their library locations.The table provides each gadget’s address, comparison instruction, and library.
- Gadget inventory: The table’s columns are Address, Comparison instruction, and Library.These fields connect each candidate gadget to the bit mask it can test and the library containing it.
B.1 SMoTher gadget
This SMoTher gadget leaks the third least-significant bit of a byte addressed through a pointer in rdx. Its instruction sequence tests the relevant memory bit and branches accordingly.
- The gadget leaks the 3rd LSB from the byte at offset 1 from the pointer in rdx.
- It tests memory at offset 0x400 from rdx before conditionally branching to alternate instruction paths.
- The sequence includes register moves and indexed memory access before later arithmetic and comparison operations.
C.1 SMoTher gadget with rdi pointer
This SMoTher gadget leaks the least-significant bit of a byte at offset 1 from a pointer in rdi. Its code tests the corresponding memory bit and follows one of two paths.
- The gadget leaks the LSB from the byte at offset 1 from the pointer in rdi.
- It tests memory at offset 0x100 from rdi and conditionally jumps based on the result.
- The gadget then performs register arithmetic and loads values from stack-relative locations.
C.2 SMoTher gadgets with r12 pointer
The listed SMoTher gadgets recover selected bits from bytes at offsets relative to r12. Their examples target offsets 56, 12, and 13, while the document also notes that results may vary across operating environments.
- The gadget at offset 56 from r12 leaks the 5th LSB of the referenced byte.
- The corresponding instruction sequences use testb operations on memory addressed through r12, followed by conditional branches.
- The gadget at offset 12 from r12 leaks the 4th LSB of the referenced byte.
- The gadget at offset 13 from r12 also leaks the 4th LSB of the referenced byte.
- The document states that results obtained in other operating environments may vary.