PaperlayerView exact revision on arXiv

Source-linked AI summary

RELOAD+REFRESH: Abusing Cache Replacement Policies to Perform Stealthy Cache Attacks

Samira Briongos, Pedro Malagón, José M. Moya, Thomas Eisenbarth

arXiv:1904.06278v1cs.CR

TL;DR

Cache sharing permits information flows across logically isolated processes, while proposed detection methods rely on measurable effects on victims. The paper reverse engineers Intel cache replacement policies and introduces RELOAD+REFRESH to track victim accesses without forcing victim-data evictions. It reports comparable attack accuracy on AES and RSA implementations with negligible victim last-level-cache misses.

  • Problem

    Cache attacks exploit shared microarchitecture despite logical isolation, while defenses face deployment barriers and detection approaches commonly rely on measurable effects on victims.

    Source: §1 · p. 1

  • Method

    The authors develop a methodology to characterize Intel cache replacement policies and use those policies to build RELOAD+REFRESH, which tracks victim accesses without forcing victim-data evictions.

    Source: §1 · p. 2, §7 · p. 14

  • Results

    RELOAD+REFRESH retrieves as much information from AES and RSA targets as other state-of-the-art cache attacks while causing negligible last-level-cache misses on victims.

    Source: §7 · p. 14

  • Takeaways & Limitations

    The authors conclude that negligible victim-side cache misses render RELOAD+REFRESH undetectable by current countermeasures.

    Source: §7 · p. 14

    Without shared memory, the approach requires adaptation to track attacker-controlled data and would constitute a different attack.

    Source: §6 · p. 12

Abstract

from arXiv · show

Caches have become the prime method for unintended information extraction across logical isolation boundaries. Even Spectre and Meltdown rely on the cache side channel, as it provides great resolution and is widely available on all major CPU platforms. As a consequence, several methods to stop cache attacks by detecting them have been proposed. Detection is strongly aided by the fact that observing cache activity of co-resident processes is not possible without altering the cache state and thereby forcing evictions on the observed processes. In this work, we show that this widely held assumption is incorrect. Through clever usage of the cache replacement policy it is possible to track a victims process cache accesses without forcing evictions on the victim's data. Hence, online detection mechanisms that rely on these evictions can be circumvented as they do not detect be the introduced RELOAD+REFRESH attack. The attack requires a profound understanding of the cache replacement policy. We present a methodology to recover the replacement policy and apply it to the last five generations of Intel processors. We further show empirically that the performance of RELOAD+REFRESH on cryptographic implementations is comparable to that of other widely used cache attacks, while its detectability becomes extremely difficult, due to the negligible effect on the victims cache access pattern.

1 Introduction

Cache sharing creates information flows across logically isolated processes, while existing detection approaches rely on measurable effects on the victim. The paper introduces RELOAD+REFRESH, which exploits Intel cache replacement policies to monitor victim accesses without forcing evictions of victim data.

1 Introduction

  • Cache side channels exploit shared hardware resources to infer sensitive data, including secret keys, across process or virtual-machine boundaries.The introduction also notes that cache attacks can break security protocols, compromise privacy, and leak information within a victim address space when combined with other techniques.Source: §1 · p. 1
  • Hardware defenses may take years to deploy, while software defenses can entail overhead; detection therefore appears practical but commonly assumes measurable effects on the victim.The paper argues that RELOAD+REFRESH challenges that assumption by keeping victim data in the cache and not significantly altering victim behavior.Source: §1 · p. 1
  • The paper presents a methodology for testing cache replacement policies and applies it to Intel Core processors from the fourth through eighth generations.The authors describe their work as the first full reverse engineering of replacement policies across these generations.Source: §1 · p. 2
  • The authors argue that their findings expand understanding of modern caches and provide a basis for improving traditional cache attacks.They state that the replacement-policy testing technique can be extended to other processors.Source: §1 · p. 2
  • The attack exploits Intel cache replacement policies to monitor victim memory accesses without forcing evictions of the victim’s data.The authors report that the approach can accurately predict which cache-set element will be replaced after a miss.Source: §1 · pp. 1–2
  • RELOAD+REFRESH causes negligible cache misses on the victim, making it undetectable by state-of-the-art countermeasures.The attack retrieves information from AES and RSA implementations with accuracy comparable to other state-of-the-art cache attacks.Source: §1 · p. 2

2 Background and related work

The background describes shared cache organization, replacement policies, established cache-attack approaches, and defenses. It highlights the unknown nature of Intel replacement policies and the reliance of detection systems on cache-miss effects.

2.1 Cache architecture

  • Modern caches are hierarchical: L1 and L2 are core-private, while the larger last-level cache is shared; set-associative caches place lines into sets based on address bits.Intel traditionally used inclusive L3 caches, although Skylake Server considers a non-inclusive last-level cache.Source: §2.1 · p. 2

2.2 Cache replacement policies

  • Replacement policies select a cache line to evict when a set is full, and Intel’s undocumented policy was not fully characterized by earlier studies.Prior work described Quad-Age LRU as the known policy name; earlier reverse engineering recovered some Intel policies but not others, while another study inferred dynamic insertion or eviction behavior.Source: §2.2 · pp. 2–3

2.3 Cache attacks

  • Cache attacks infer victim activity from cache hit and miss patterns, typically through initialization, waiting, and recovery stages.FLUSH+RELOAD and PRIME+PROBE are described as higher-resolution approaches than other traditional categories.Source: §2.3 · p. 3

2.3.1 FLUSH+RELOAD

  • FLUSH+RELOAD requires shared memory: the attacker flushes target lines, waits for the victim, and times a reload to infer whether the victim used the data.The cited work extends the attack to LLC-based recovery of cryptographic keys, TLS messages, and keystrokes; FLUSH+FLUSH instead times clflush, though later work showed it detectable.Source: §2.3.1 · p. 3

2.3.2 PRIME+PROBE

  • PRIME+PROBE does not require special OS features and can target dynamically allocated data by priming a set, waiting, and probing for timing variation.The background also describes PRIME+ABORT, which uses Intel TSX transactions to detect whether a victim accessed a primed set.Source: §2.3.2 · pp. 3–4

2.4 Countermeasures

  • Defenses include hardware changes, software resource controls, and monitoring, but deployment and performance costs constrain their use.Detection systems monitor cache-miss effects on the victim or attacker, so an attack that avoids victim-side misses would be undetectable by those systems.Source: §2.4 · p. 4

3 Retrieval of Intel cache eviction policies

The section develops a way to recover Intel LLC replacement policies by comparing observed cache behavior with software models. Across tested processors, the authors report accurate eviction predictions and describe how policy behavior varies by cache set and insertion mode.

Input: Eviction_set, Conflicting set candidates Output: Conflicting_set

  • An eviction set and a disjoint conflicting set, both mapping to one cache set, let the authors force misses and observe which line is evicted.They dynamically construct these sets; a candidate joins the conflicting set when its reload time exceeds a threshold after the access sequence.Source: §3 · p. 4, Input: Eviction_set, Conflicting set… · p. 5

3.1 Design of the experiments

  • The recovery procedure compares each set’s observed runtime evolution with manually defined replacement-policy models and selects the best-matching policy.The software model tracks set contents and policy control bits to predict the eviction candidate.Source: §3.1 · p. 5

3.2 Results

  • The newer tested processors have twice as many LLC slices as physical cores, while fourth- and fifth-generation machines have one slice per physical core.The newer machines have as many slices as virtual cores.Source: §3.2 · p. 6
  • Only the i7-4790 and i3-5010U use set dueling; their cache slices contain fixed-policy control sets and other sets with varying policies.The authors report that only one set per slice has a fixed policy and that testing sets without order helps locate the control sets.Source: §3.2 · p. 6
  • Over 98% of evictions were correctly predicted for sets with fixed policy, with errors likely due to noise.The reported result applies to fixed-policy sets in the tested machines.Source: §3.2 · p. 6
  • The tested Intel processors share the same Quad-Age LRU eviction rule, while insertion age differs across generations and set-dueling modes.The i7-4790 and i3-5010U use insertion ages 2 or 3; the three newer tested machines always insert at age 2.Source: §3.2 · p. 7

4 RELOAD+REFRESH

RELOAD+REFRESH exploits cache replacement state to infer victim accesses without causing a cache miss on the victim. The attack uses controlled cache-set placement and refresh steps, with a noise-tolerant variant under a stated assumption.

4 RELOAD+REFRESH

  • The attacker makes the target the eviction candidate; a victim access changes that candidate, which the attacker detects by forcing a miss and reloading the target without a victim cache miss.The attacker then restores the set state for the next observation.Source: §4 · p. 8
  • With mode 2, the attack needs no refresh when victim and attacker are on different cores, but same-core use requires refreshing other elements to remove the target from low-level caches.The mode 2 approach also supports a detectable fast cross-core attack without shared memory.Source: §4 · pp. 8–9
  • For insertion age 2, initialization fills the set with the target and W −1 eviction-set elements, then flushes and reloads them to establish insertion order.RELOAD detects victim use; REFRESH prepares the set for the next observation.Source: §4 · p. 9

4.1 Noise tolerance

  • The noise-tolerant variant assumes only one address is used by the noise process and places the target second, allowing the attacker to evict noise while distinguishing victim use.Refresh-time measurements can reveal other processes using the set.Source: §4.1 · p. 9, Input: Eviction_set Output: Refresh time · p. 10

5 Results

The experiments apply RELOAD+REFRESH to AES and RSA implementations and compare it with FLUSH+RELOAD and PRIME+PROBE. The attack performs comparably in key-retrieval experiments while producing little change in measured victim cache misses.

5.1 Attacking AES

  • RELOAD+REFRESH needs nearly as few samples as FLUSH+RELOAD and fewer than PRIME+PROBE to retrieve the AES key.The comparison monitors one T-table line at a time; Table 2 reports mean samples for each four-byte key group.Source: Table 2 · p. 10, §5.1 · p. 10

5.1.1 Detection evaluation

  • For AES, victim misses under RELOAD+REFRESH cannot be distinguished from normal encryption by measuring their distribution.The paper reports about 20% of PRIME+PROBE runs cause no victim misses.Source: §5.1.1 · p. 11, Figure 7 · p. 11
  • 595 cycles without attack and 623 cycles under RELOAD+REFRESH were the mean AES encryption times; the difference was not significant compared with other attacks.The paper attributes the increase to victim data being loaded from L3 rather than L1 or L2.Source: §5.1.1 · p. 11, Figure 8 · p. 11

5.2 Attacking RSA

  • In RSA experiments, RELOAD+REFRESH performs similarly to FLUSH+RELOAD, while total misses per decryption do not indicate an attack.The attack and PRIME+PROBE produce fewer total misses than the no-attack case; periodic measurements show RELOAD+REFRESH misses close to normal after initialization and do not trigger the cited CacheShield alarm.Source: §5.2 · p. 12, §5.2.1 · p. 12

5.2.1 Detection evaluation

  • In RSA, periodic miss measurements show RELOAD+REFRESH misses near zero after initialization, unlike the noticeable misses from FLUSH+RELOAD and PRIME+PROBE.The authors note a few misses may occur when victim and attacker access the monitored line simultaneously.Source: §5.2.1 · p. 12

6 Discussion of the results

RELOAD+REFRESH uses replacement-policy knowledge to monitor victim accesses while limiting victim-side cache misses, but adds attacker-side work. Its sampling is slower than FLUSH+RELOAD, yet it retrieved 93% of RSA multiply executions in the reported 1024-bit-key test.

6 Discussion of the results

  • Accurate timers and clflush let the attacker trace cache accesses and set cache-line ages, while deterministic replacement predicts which line a miss will evict.Source: §6 · p. 12
  • With memory sharing, RELOAD+REFRESH exploits the eviction policy; without it, the authors describe tracking attacker-controlled data as a possible adaptation left for future work.In that proposed adaptation, the target is evicted only if the victim does not use it, so misses would be limited during encryption.Source: §6 · p. 12
  • Knowing the eviction policy can reduce false positives in PRIME+PROBE and EVICT+RELOAD, and may reduce some PROBE steps to one access.Source: §6 · p. 12

6.1 Performance of Reload+Refresh

  • RELOAD+REFRESH’s sequential RELOAD and REFRESH operations took a mean of 1520 cycles, versus 1012 and 447 cycles for the individual operations.The paper expects REFRESH time to increase proportionally with the number of ways per set, while RELOAD time should not vary.Source: §6.1 · p. 13
  • RELOAD+REFRESH does not lose accuracy, but its extra accesses reduce performance; mean sample intervals were about 260 cycles for FLUSH+RELOAD and 810 cycles for PRIME+PROBE.PRIME+PROBE sample intervals varied from 280 to 1950 cycles, making resolutions below 1950 harder to obtain accurately.Source: §6.1 · p. 13
  • 93% of multiply executions were retrieved for 1024-bit RSA keys using RELOAD+REFRESH at maximum speed.The authors report that PRIME+PROBE and RELOAD+REFRESH may have trouble collecting the proper number of samples at this key length.Source: §6.1 · p. 13

7 Conclusion

The authors analyze Intel cache replacement policies across generations 4 through 8 using a method that checks predicted eviction candidates against actual evictions. They report that RELOAD+REFRESH extracts information from AES and RSA while causing negligible last-level-cache misses, and that the results can improve cache understanding and existing attacks.

7 Conclusion

  • The replacement-policy analysis covers Intel processors from the 4th through 8th generations and tests predictions against the data actually evicted after a forced miss.Source: §7 · p. 14
  • RELOAD+REFRESH retrieved as much information from AES and RSA as other state-of-the-art cache attacks while causing negligible last-level-cache misses.Source: §7 · p. 14
  • The results broaden understanding of modern CPU caches and can improve previous attacks and eviction strategies.Source: §7 · p. 14
Loading 1904.06278v1…