Title:

Spectre Declassified: Reading from the Right Place at the Wrong Time

 

Abstract:

Modern CPUs speed up programs by predicting future instructions and speculatively executing them. In the case of a correct prediction, the performance gained is obvious. On the other hand, in a misprediction the CPU ignores computed results and rolls back to the point where the misprediction occurred. Even though incorrect speculatively executed results are disregarded, the Spectre attacks have shown that those incorrect results remain visible in microarchitectural states and can be used to infer programs’ behavior including secret values in the computation.

This talk revisits Spectre v1 vulnerabilities and shows that existing approaches do not fully prevent unintended data leakage. We demonstrate an example attacking AES which can bypass controlled leakage policies constructed by a programmer. We further show that the attack can bypass standard defense techniques, such as Speculative Load Hardening (SLH). To address this issue, we propose potential countermeasures with negligible performance impact.

Joint work with Basavesh Ammanaghatta Shivakumar, Jack Barnes, Gilles Barthe, Sunjay Cauligi, Daniel Genkin, Sioli O’Connell, Peter Schwabe, Rui Qi Sim, and Yuval Yarom

Paper: https://eprint.iacr.org/2022/426

 

Presentation slides

 

Speaker:

Chitchanok Chuengsatiansup

Assistant Professor
University of Adelaide