Nothing Special   »   [go: up one dir, main page]

skip to main content
10.1145/3386263.3407584acmotherconferencesArticle/Chapter ViewAbstractPublication PagesglsvlsiConference Proceedingsconference-collections
short-paper

Evolution of Defenses against Transient-Execution Attacks

Published: 07 September 2020 Publication History

Abstract

Transient-execution attacks, such as Meltdown and Spectre, exploit performance optimizations in modern CPUs to enable unauthorized access to data across protection boundaries. Against these attacks, we have noticed a rapid growth of deployed and proposed countermeasures. In this paper, we show the evolution of countermeasures against transient-execution attacks by both industry and academia since the initial discoveries of the attacks. We show that despite the advances in the understanding and systematic view of the field, the proposed and deployed defenses are limited.

Supplementary Material

MP4 File (3386263.3407584.mp4)
Presentation video

References

[1]
Sam Ainsworth and Timothy M Jones. 2019. Muon Trap: Preventing Cross-Domain Spectre-Like Attacks by Capturing Speculative State. arXiv:1911.08384.
[2]
Alejandro Cabrera Aldaya, Billy Bob Brumley, Sohaib ul Hassan, Cesar Pereida García, and Nicola Tuveri. 2019. Port contention for fun and profit. In S&P.
[3]
AMD. 2018. AMD64 Technology: Speculative Store Bypass Disable.
[4]
AMD. 2018. Software Techniques for Managing Speculation on AMD Processor.
[5]
Nadav Amit, Fred Jacobs, and Michael Wei. 2019. Jumpswitches: restoring the performance of indirect branches in the era of spectre. In USENIX ATC.
[6]
Orlando Arias, David Gens, Yier Jin, Christopher Liebchen, Ahmad-Reza Sadeghi, and Dean Sullivan. 2017. LAZARUS: Practical Side-channel Resilient Kernel-Space Randomization. In RAID.
[7]
ARM. 2013. ARM Architecture Reference Manual ARMv8.
[8]
ARM. 2018. Cache Speculation Side-channels.
[9]
Musard Balliu, Mads Dam, and Roberto Guanciale. 2019. In Spectre: Breaking and Fixing Microarchitectural Vulnerabilities by Formal Analysis. arXiv:1911.00868.
[10]
Julian Bangert, Sergey Bratus, Rebecca Shapiro, Michael E Locasto, Jason Reeves,Sean W Smith, and Anna Shubina. 2013. ELFbac: using the loader format for intent-level semantics and fine-grained protection. Dartmouth Technical Report.
[11]
Kristin Barber, Anys Bacha, Li Zhou, Yinqian Zhang, and Radu Teodorescu. 2019. Specshield: Shielding speculative data from microarchitectural covert channels. In PACT.
[12]
Atri Bhattacharyya, Alexandra Sandulescu, Matthias Neugschwandtner, Alessandro Sorniotti, Babak Falsafi, Mathias Payer, and Anil Kurmus. 2019. Smotherspectre: exploiting speculative execution through port contention. In CCS.
[13]
Thomas Bourgeat, Ilia Lebedev, Andrew Wright, Sizhuo Zhang, and Srinivas Devadas. 2019. MI6: Secure enclaves in a speculative out-of-order processor. In MICRO.
[14]
R Branco, K Hu, K Sun, and H Kawakami. 2019. Efficient mitigation of side-channel based attacks against speculative execution processing architectures.
[15]
Gianpiero Cabodi, Paolo Camurati, Fabrizio Finocchiaro, and Danilo Vendraminetto. 2019. Model-Checking Speculation-Dependent Security Properties: Abstracting and Reducing Processor Models for Sound and Complete Verification. Electronics(2019).
[16]
Claudio Canella, Khaled N. Khasawneh, and Daniel Gruss. 2020. The Evolution of Transient-Execution Attacks. In GLSVLSI.
[17]
Claudio Canella, Michael Schwarz, Martin Haubenwallner, Martin Schwarzl, and Daniel Gruss. 2020. KASLR: Break It, Fix It, Repeat. In AsiaCCS.
[18]
Claudio Canella, Jo Van Bulck, Michael Schwarz, Moritz Lipp, Benjamin von Berg, Philipp Ortner, Frank Piessens, Dmitry Evtyushkin, and Daniel Gruss. 2019. A Systematic Evaluation of Transient Execution Attacks and Defenses. In USENIX Security. Extended classification tree and PoCs at https://transient.fail/.
[19]
Chandler Carruth. 2018. RFC: Speculative Load Hardening (a Spectre variant 1 mitigation).
[20]
Guoxing Chen, Mengyuan Li, Fengwei Zhang, and Yinqian Zhang. 2019. Defeating Speculative-Execution Attacks on SGX with Hyper Race. In DSC.
[21]
Chromium Projects. 2018. Actions required to mitigate Speculative Side-Channel Attack techniques.
[22]
Chromium Projects. 2018. Site Isolation.
[23]
Jonathan Corbet. 2017. The current state of kernel page-table isolation.
[24]
Microsoft Corp. 2019. https://support.microsoft.com/en-us/help/4482887/windows-10-update-kb4482887
[25]
Sai Manoj P D, Sairaj Amberkar, Sahil Bhat, Abhijitt Dhavlle, Hossein Sayadi,Avesta Sasan, Houman Homayoun, and Setareh Rafatirad. 2019. Adversarial attack on microarchitectural events based malware detectors. In DAC.
[26]
Jonas Depoix and Philipp Altmeyer. 2018. Detecting Spectre Attacks by identifying Cache Side-Channel Attacks using Machine Learning. WAMOS(2018).
[27]
Xiaowan Dong, Zhuojia Shen, John Criswell, Alan Cox, and Sandhya Dwarkadas. 2018. Spectres, virtual ghosts, and hardware support. In HASP.
[28]
Swastika Dutta and Sayan Sinha. 2019. Performance statistics and learning based detection of exploitative speculative attacks. In CF.
[29]
R Earnshaw. 2018. Mitigation against unsafe data speculation (CVE-2017--5753).
[30]
Mohammad Rahmani Fadiheh, Dominik Stoffel, Clark Barrett, Subhasish Mitra, and Wolfgang Kunz. 2019. Processor hardware security vulnerabilities and their detection by unique program execution checking. In DATE.
[31]
Andrew Ferraiuolo, Mark Zhao, Andrew C Myers, and G Edward Suh. 2018. Hyper Flow: A processor architecture for nonmalleable, timing-safe information flow security. In CCS.
[32]
Jacob Fustos, Farzad Farshchi, and Heechul Yun. 2019. Spectre Guard: An Efficient Data-centric Defense Mechanism against Spectre Attacks. In DAC.
[33]
Jingquan Ge, Neng Gao, Chenyang Tu, Ji Xiang, and Zeyi Liu. 2019. AdapTimer: Hardware/Software Collaborative Timer Resistant to Flush-Based Cache Attacks on ARM-FPGA Embedded SoC. In ICCD.
[34]
Abraham Gonzalez, Ben Korpan, Jerry Zhao, Ed Younis, and Krste Asanovi?. 2019. Replicating and Mitigating Spectre Attacks on an Open Source RISC-V Microarchitecture. In CARRV.
[35]
Daniel Gruss, Dave Hansen, and Brendan Gregg. 2018. Kernel isolation: Froman academic idea to an efficient patch for every computer.; login: the USENIX Magazine(2018).
[36]
Daniel Gruss, Moritz Lipp, Michael Schwarz, Richard Fellner, Clémentine Maurice, and Stefan Mangard. 2017. Kaslr is dead: long live kaslr. In ESSoS.
[37]
Daniel Gruss, Clémentine Maurice, Anders Fogh, Moritz Lipp, and Stefan Mangard. 2016. Prefetch side-channel attacks: Bypassing SMAP and kernel ASLR. In CCS.
[38]
Austin Harris, Shijia Wei, Prateek Sahu, Pranav Kumar, Todd Austin, and Mohit Tiwari. 2019. Cyclone: Detecting Contention-Based Cache Information Leaks Through Cyclic Interference. In MICRO.
[39]
Wei-Ming Hu. 1992. Reducing timing channels with fuzzy time.Journal of computer security(1992).
[40]
Zhichao Hua, Dong Du, Yubin Xia, Haibo Chen, and Binyu Zang. 2018. EPTI: Efficient Defense against Meltdown Attack for Unpatched VMs. In USENIXATC.
[41]
Intel. 2018. Deep Dive: Intel Analysis of L1 Terminal Fault.
[42]
Intel. 2018. Intel Analysis of Speculative Execution Side Channels.
[43]
Intel. 2018. Retpoline: A Branch Target Injection Mitigation. Revision.
[44]
Intel. 2018. Speculative Execution Side Channel Mitigations.
[45]
Intel. 2019. Intel 64 and IA-32 architectures software developer's manual.
[46]
Intel. 2020. Deep Dive: Load Value Injection.
[47]
Intel. 2020. Side Channel Mitigation by Product CPU Model.
[48]
Ira Ray Jenkins, Prashant Anantharaman, Rebecca Shapiro, J Peter Brady, Sergey Bratus, and Sean W Smith. 2020. Ghostbusting: Mitigating spectre with intraprocess memory isolation. In HoTSoS.
[49]
Khaled N Khasawneh, Nael Abu-Ghazaleh, Dmitry Ponomarev, and Lei Yu. 2017. RHMD: Evasion-resilient hardware malware detectors. In MICRO.
[50]
Khaled N Khasawneh, Nael B Abu-Ghazaleh, Dmitry Ponomarev, and Lei Yu. 2018. Adversarial Evasion-Resilient Hardware Malware Detectors. In ICCAD.
[51]
Khaled N Khasawneh, Esmaeil Mohammadian Koruyeh, Chengyu Song, Dmitry Evtyushkin, Dmitry Ponomarev, and Nael Abu-Ghazaleh. 2019. Safespec: Banishing the spectre of a meltdown with leakage-free speculation. In DAC.
[52]
Russel King. 2018. Spectre-v2: harden branch predictor on context switches.
[53]
Vladimir Kiriansky, Ilia Lebedev, Saman Amarasinghe, Srinivas Devadas, and Joel Emer. 2018. DAWG: A defense against cache timing attacks in speculative execution processors. In MICRO.
[54]
Vladimir Kiriansky and Carl Waldspurger. 2018. Speculative buffer overflows: Attacks and defenses. arXiv:1807.03757(2018).
[55]
Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, et al.2019. Spectre attacks: Exploiting speculative execution. In S&P.
[56]
Igor Korkin. 2018. Divide et Impera: Memory Ranger Runs Drivers in Isolated Kernel Spaces. arXiv:1812.09920(2018).
[57]
Esmaeil Mohammadian Koruyeh, Shirin Haji Amin Shirazi, Khaled N Kha-sawneh, Chengyu Song, and Nael Abu-Ghazaleh. 2019. SPECCFI: Mitigating Spectre Attacks using CFI Informed Speculation.arXiv:1906.01345(2019).
[58]
Congmiao Li and Jean-Luc Gaudiot. 2020. Challenges in Detecting an "Evasive Spectre". IEEE Computer Architecture Letters(2020).
[59]
Peinan Li, Lutan Zhao, Rui Hou, Lixin Zhang, and Dan Meng. 2019. Conditional Speculation: An effective approach to safeguard out-of-order execution against spectre attacks. In HPCA.
[60]
Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, and Mike Hamburg. 2018. Meltdown: Reading Kernel Memory fromUser Space. In USENIX Security.
[61]
Jason Lowe-Power, Venkatesh Akella, Matthew K Farrens, Samuel T King, and Christopher J Nitta. 2018. Position Paper: A case for exposing extra-architectural state in the ISA. In HASP.
[62]
Ross Mcilroy, Jaroslav Sevcik, Tobias Tebbi, Ben L Titzer, and Toon Verwaest. 2019. Spectre is here to stay: An analysis of side-channels and speculative execution. arXiv:1902.05178(2019).
[63]
Avi Mendelson. 2019. Secure Speculative Core. In IEEE SOCC.
[64]
Microsoft. 2018. Microsoft Techcommunity. Hyper-V Hyper Clear Mitigation for L1 Terminal Fault.
[65]
Microsoft. 2018. Mitigating speculative execution side-channel attacks in Microsoft Edge and Internet Explorer.
[66]
Shravan Narayan, Craig Disselkoen, Tal Garfinkel, Nathan Froyd, Eric Rahm, Sorin Lerner, Hovav Shacham, and Deian Stefan. 2020. Retrofitting Fine Grain Isolation in the Firefox Renderer. In USENIX Security.
[67]
Ejebagom John Ojogbo, Mithuna Thottethodi, and TN Vijaykumar. 2020. Secure automatic bounds checking: prevention is simpler than cure. In CGO.
[68]
Oleksii Oleksenko, Bohdan Trach, Tobias Reiher, Mark Silberstein, and Christof Fetzer. 2018. You shall not bypass: Employing data dependencies to prevent bounds check bypass. arXiv:1805.08506(2018).
[69]
Hamza Omar and Omer Khan. 2019. IRONHIDE: A Secure Multicore Architecture that Leverages Hardware Isolation Against Microarchitecture State Attacks. arXiv:1904.12729(2019).
[70]
Tapti Palit, Fabian Monrose, and Michalis Polychronakis. 2019. Mitigating data leakage by protecting memory-resident sensitive data. In ACSAC.
[71]
Peter Pessl, Daniel Gruss, Clémentine Maurice, Michael Schwarz, and Stefan Mangard. 2016. DRAMA: Exploiting DRAM addressing for cross-cpu attacks. In USENIX Security.
[72]
Filip Pizlo. 2018. What Spectre and Meltdown mean for WebKit.
[73]
Charles Reis, Alexander Moshchuk, and Nasko Oskov. 2019. Site isolation:process separation for web sites within the browser. In USENIX Security.
[74]
Simon Rokicki. 2020. GhostBusters: Mitigating Spectre Attacks on a DBT-Based Processor. In DATE.
[75]
Majid Sabbagh, Yunsi Fei, Thomas Wahl, and A Adam Ding. 2018. SCADET: aside-channel attack detection tool for tracking Prime+ Probe. InICCAD.
[76]
Gururaj Saileshwar and Moinuddin K Qureshi. 2019. Cleanup Spec: An "Undo" Approach to Safe Speculation. In MICRO.
[77]
Christos Sakalis, Mehdi Alipour, Alberto Ros, Alexandra Jimborean, Stefanos Kaxiras, and Magnus Själander. 2019. Ghost loads: what is the cost of invisible speculation?. In CF.
[78]
Christos Sakalis, Stefanos Kaxiras, Alberto Ros, Alexandra Jimborean, and Magnus Själander. 2019. Efficient invisible speculative execution through selective delay and value prediction. In ISCA.
[79]
Michael Schwarz, Moritz Lipp, Claudio Canella, Robert Schilling, Florian Kargl, and Daniel Gruss. 2020. ConTExT: A Generic Approach for Mitigating Spectre. In NDSS.
[80]
Michael Schwarz, Moritz Lipp, and Daniel Gruss. 2018. JavaScript Zero: Real Java Script and Zero Side-Channel Attacks. In NDSS.
[81]
Michael Schwarz, Clémentine Maurice, Daniel Gruss, and Stefan Mangard. 2017.Fantastic timers and where to find them: high-resolution microarchitectural attacks in JavaScript. In FC.
[82]
Michael Schwarz, Martin Schwarzl, Moritz Lipp, Jon Masters, and Daniel Gruss.2019. Netspectre: Read arbitrary memory over network. In ESORICS.
[83]
Zhuojia Shen, Jie Zhou, Divya Ojha, and John Criswell. 2018. Restricting control flow during speculative execution. In CCS.
[84]
Johannes Sianipar, Muhammad Sukmana, and Christoph Meinel. 2018. Moving Sensitive Data Against Live Memory Dumping, Spectre and Meltdown Attacks. In 2018 26th International Conference on Systems Engineering (ICSEng). IEEE.
[85]
Ben Smith. 2018. Enable Shared Array Buffer by default on non-android.
[86]
Julian Stecklina and Thomas Prescher. 2018. Lazyfp: Leaking fpu register state using microarchitectural side-channels.arXiv:1806.07480(2018).
[87]
SUSE. 2018. Security update for kernel-firmware. https://www.suse.com/support/update/announcement/2018/suse-su-20180008--1
[88]
Mohammadkazem Taram, Ashish Venkat, and Dean Tullsen. 2019. Context-sensitive fencing: Securing speculative execution via microcode customization. In ASPLOS.
[89]
Paul Turner. 2018. Retpoline: a software construct for preventing branch-target-injection.
[90]
Eben Upton. 2018. Why Raspberry Pi isn't vulnerable to Spectre or Meltdown.
[91]
Jo Van Bulck, Daniel Moghimi, Michael Schwarz, Moritz Lipp, Marina Minkin, Daniel Genkin, Yarom Yuval, Berk Sunar, Daniel Gruss, and Frank Piessens.2020. LVI: Hijacking Transient Execution through Microarchitectural LoadValue Injection. In S&P.
[92]
Marco Vassena, Klaus V Gleissenthall, Rami Gökhan Kici, Deian Stefan, and Ranjit Jhala. 2020. Automatically eliminating speculative leaks with blade. arXiv:2005.00294(2020).
[93]
Ilias Vougioukas, Nikos Nikoleris, Andreas Sandberg, Stephan Diestelhorst, Bashir M Al-Hashimi, and Geoff V Merrett. 2019. BRB: Mitigating Branch Predictor Side-Channels. In HPCA.
[94]
Luke Wagner. 2018. Mitigations landing for new class of timing attack.
[95]
Han Wang, Hossein Sayadi, Tinoosh Mohsenin, Liang Zhao, Avesta Sasan,Setareh Rafatirad, and Houman Homayoun. 2020. Mitigating Cache-BasedSide-Channel Attacks through Randomization: A Comprehensive System and Architecture Level Analysis. DATE.
[96]
Robert NM Watson, Jonathan Woodruff, Michael Roe, Simon W Moore, and Peter G Neumann. 2018. Capability hardware enhanced RISC instructions (CHERI):Notes on the Meltdown and Spectre attacks. Technical Report.
[97]
Ofir Weisse, Ian Neal, Kevin Loughlin, Thomas F Wenisch, and Baris Kasikci. 2019. Nda: Preventing speculative execution attacks at their source. InMICRO.
[98]
Ofir Weisse, Jo Van Bulck, Marina Minkin, Daniel Genkin, Baris Kasikci, Frank Piessens, Mark Silberstein, Raoul Strackx, Thomas F Wenisch, and Yuval Yarom. 2018. Foreshadow-NG: Breaking the virtual memory abstraction with transientout-of-order execution.
[99]
Wenjie Xiong and Jakub Szefer. 2020. Survey of Transient Execution Attacks. arXiv:2005.13435(2020).
[100]
Mengjia Yan, Jiho Choi, Dimitrios Skarlatos, Adam Morrison, Christopher Fletcher, and Josep Torrellas. 2018. Invisispec: Making speculative execution invisible in the cache hierarchy. InMICRO.
[101]
Jiyong Yu, Mengjia Yan, Artem Khyzha, Adam Morrison, Josep Torrellas, and Christopher W Fletcher. 2019. Speculative Taint Tracking (STT) A Comprehensive Protection for Speculatively Accessed Data. In MICRO.
[102]
Lutan Zhao, Peinan Li, Rui Hou, Jiazhen Li, Michael C Huang, Lixin Zhang, Xuehai Qian, and Dan Meng. 2020. A Lightweight Isolation Mechanism for Secure Branch Predictors. arXiv:2005.08183(2020).

Cited By

View all
  • (2023)Ultimate SLHProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620636(7125-7142)Online publication date: 9-Aug-2023
  • (2023)Transient-Execution Attacks: A Computer Architect PerspectiveACM Computing Surveys10.1145/360361956:3(1-38)Online publication date: 6-Oct-2023
  • (2023)You Cannot Always Win the Race: Analyzing mitigations for branch target prediction attacks2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P)10.1109/EuroSP57164.2023.00046(671-686)Online publication date: Jul-2023
  • Show More Cited By

Recommendations

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Other conferences
GLSVLSI '20: Proceedings of the 2020 on Great Lakes Symposium on VLSI
September 2020
597 pages
ISBN:9781450379441
DOI:10.1145/3386263
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 07 September 2020

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. LVI
  2. meltdown
  3. spectre
  4. transient-execution attacks

Qualifiers

  • Short-paper

Funding Sources

  • Horizon 2020
  • ARM
  • Österreichische Forschungsförderungsgesellschaft

Conference

GLSVLSI '20
GLSVLSI '20: Great Lakes Symposium on VLSI 2020
September 7 - 9, 2020
Virtual Event, China

Acceptance Rates

Overall Acceptance Rate 312 of 1,156 submissions, 27%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)46
  • Downloads (Last 6 weeks)6
Reflects downloads up to 27 Nov 2024

Other Metrics

Citations

Cited By

View all
  • (2023)Ultimate SLHProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620636(7125-7142)Online publication date: 9-Aug-2023
  • (2023)Transient-Execution Attacks: A Computer Architect PerspectiveACM Computing Surveys10.1145/360361956:3(1-38)Online publication date: 6-Oct-2023
  • (2023)You Cannot Always Win the Race: Analyzing mitigations for branch target prediction attacks2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P)10.1109/EuroSP57164.2023.00046(671-686)Online publication date: Jul-2023
  • (2023)SoK: Analysis of Root Causes and Defense Strategies for Attacks on Microarchitectural Optimizations2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P)10.1109/EuroSP57164.2023.00044(631-650)Online publication date: Jul-2023
  • (2022)Verified programs can partyProceedings of the Seventeenth European Conference on Computer Systems10.1145/3492321.3519562(283-299)Online publication date: 28-Mar-2022
  • (2022)SoK: Practical Foundations for Software Spectre Defenses2022 IEEE Symposium on Security and Privacy (SP)10.1109/SP46214.2022.9833707(666-680)Online publication date: May-2022
  • (2022)Container Technologies for ARM Architecture: A Comprehensive Survey of the State-of-the-ArtIEEE Access10.1109/ACCESS.2022.319715110(84853-84881)Online publication date: 2022
  • (2022)Simulating Modern CPU Vulnerabilities on a 5-stage MIPS Pipeline Using Node-REDAdvances in Data Computing, Communication and Security10.1007/978-981-16-8403-6_65(707-716)Online publication date: 29-Mar-2022
  • (2021)Branchless Code Generation for Modern Processor ArchitecturesProceedings of the 25th Pan-Hellenic Conference on Informatics10.1145/3503823.3503879(300-305)Online publication date: 26-Nov-2021
  • (2021)BasicBlocker: ISA Redesign to Make Spectre-Immune CPUs FasterProceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses10.1145/3471621.3471857(103-118)Online publication date: 6-Oct-2021
  • Show More Cited By

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media