Karl Taht's Research Paper Blog

Normally, I prefer to keep these blog posts very academic. However, I'd like to move to a more conversational format, and I think this paper presents the perfect starting point for such a shift. This paper is one of the more "advanced" papers I've read. It requires a rich and detailed understanding of computer architecture details AND operating system constructs. This post may contain misinformation, and therefore I advise any potential reader to consider reading the paper. *** Spectre leverages speculative execution to expose a timing side-channel. The two main variants described in this paper are the Variant 1: Bounds Check Bypass and Variant 2: Branch Target Injection. It is worth noting that Spectre attacks are perhaps most useful in the case of trying to access data within the same process. The common example of this is a web browser which runs multiple threads and JavaScript. The site's Java script can use Spectre to gain access to what you are typing in...

Authors: Mortiz Lipp, Michael Schwarz, Daniel Gruss, et. al Venue: arXiv This paper is one of the massive mainstream security vulnerabilities exposed in 2018 for CPUs. The attack initially was independent of software vulnerabilities, and works even with the presence of KASLR/ASLR. The attack is based off speculative execution, which can result in what they call "transient instructions". These instructions begin execution, but do not finish so there is no change in architectural state. However, their are micro-architectural artifacts, which can be exploited via the Flush+Reload attack methodology. There are three main details worth explaining that are non-trivial: 1. Exception handling. When the program attempts to read from kernel memory, this will cause an exception. One way to handle this is via having the exception happen on a separate thread. However, an even more elegant solution is to put the attack in Intel TSX (transactional memory). In this case, an exception is...