Spectre Attacks: Exploiting Speculative Execution

Normally, I prefer to keep these blog posts very academic. However, I'd like to move to a more conversational format, and I think this paper presents the perfect starting point for such a shift. This paper is one of the more "advanced" papers I've read. It requires a rich and detailed understanding of computer architecture details AND operating system constructs. This post may contain misinformation, and therefore I advise any potential reader to consider reading the paper.

***

Spectre leverages speculative execution to expose a timing side-channel. The two main variants described in this paper are the Variant 1: Bounds Check Bypass and Variant 2: Branch Target Injection. It is worth noting that Spectre attacks are perhaps most useful in the case of trying to access data within the same process. The common example of this is a web browser which runs multiple threads and JavaScript. The site's Java script can use Spectre to gain access to what you are typing in other browser tabs, for example. While chrome does a good job at mitigating this form of attack, it is only one such example.

Variant 1: Bounds Check Bypass (BCB) In this variant the attacker trains the branch predictor to predict a branch that a segment of code will access a valid address. Once the predictor is primed, a bad address can be used which would fail the bounds check. However, speculatively, we can access the code beyond the bypass. This will leave cache effects, which can then be timed.

Variant 2: Branch Target Injection (BTI) and Return-oriented Programming (ROP) This variant involves training a branch within the victim's address space. First, a "gadget" is selected within the victim's address space. This can be done by frequently calling a function with a valid input. Once primed, the function can be called with an invalid input which leaves side-effects.

This is as much detail as I feel comfortable providing in this write-up. The important note here is that this type of speculative attack leaves many vulnerabilities, and, is not fixed KPTI/KAISER.

Full Text

Comments

Post a Comment

Popular posts from this blog

Fundamental Latency Trade-offs in Architecting DRAM Caches (Alloy Cache)

Authors: Moinuddin K. Qureshi and Gabriel H. Loh Venue:    MICRO 2012 The authors present a new architecture for DRAM cache which targets optimizing latency rather than hit rate. The authors show that for every optimization made to improve hit rate, one must also consider the added cache latency, thus resulting in a new "break even hit rate". The authors compare to three key baselines: an infeasibly large SRAM-tag array, the prior "LH-Cache", and a ideal latency-optimized cache. They find that "unoptimizations" improve latency, while minimally impacting hit-rate. Their final result is a cache which boosts performance 35% improvement over the baseline, and nearly 20% better than the previous LH-cache. The specific contributions are: Moving to a direct mapped cache provides significant improvement (by reducing latency) Combining tag-store and data-store into a single entity improves performance 21% Implementing a small per-core predictor enhances per...
Read more

ZCOMP: Reducing DNN Cross-Layer Memory Footprint Using Vector Extensions

Authors: Berkin Akin, Zeshan A. Christi, and Alaa R. Alameldeen Venue: MICRO, 2019 With accelerators dominating the deep learning space in architecture conferences, this paper stands out as it focuses on reducing DNN inference/training overhead while using a CPU. An obvious question is, with the wide-spread use of GPUs/TPUs for deep learning, why should we focus on optimizing CPUs for deep learning. In a recent paper published at HPCA 2019, Facebook claims that CPUs are preferred for applications where a tight integration is required between DNN and non-DNN tasks. Also, Intel's recent AVX512 has specialized support for DNNs in the form of new instructions called Vector Neural Network Instructions (VNNI). Broadly, optimizing DNNs can be viewed from two different perspectives; computation, and communication. This paper targets reducing communication overhead, more specifically, activation or feature-map communication overhead by compressing them. Compressing activations/weights...
Read more

AutoFDO: Automatic Feedback-Directed Optimization for Warehouse-Scale Applications

Authors: Dehao Chen, David Xinliang Li, Tipp Moseley Venue:    CGO 2016 This paper presents AutoFDO, a system used which profiles warehouse-scale applications, and applies feedback to the compilation for the next release. AutoFDO works by profiling and storing profiles in an aggregate database, annotating the profiles via an intermediate representation, and finally providing feedback. On average, this technique boosts performance by around 10% and works well even with stale releases. For profiles to be useful, they must be in an intermediate representation. This is built from binary-level profile, which uses LBR to map instruction frequencies. By using these frequencies, program counters, and the source, a source profile can be generated. The source profile can be used to build an annotated call-graph with edge frequencies, with some inaccuracy. These annotated call-graphs can then be used as feedback to the compiler. Because of the size of the applications and scale of d...
Read more