research-article

Speculative Load Forwarding Attack on Modern Processors

Authors:

Hasini Witharana,

Prabhat MishraAuthors Info & Claims

ICCAD '22: Proceedings of the 41st IEEE/ACM International Conference on Computer-Aided Design

Article No.: 144, Pages 1 - 9

https://doi.org/10.1145/3508352.3549417

Published: 22 December 2022 Publication History

Abstract

Modern processors deliver high performance by utilizing advanced features such as out-of-order execution, branch prediction, speculative execution, and sophisticated buffer management. Unfortunately, these techniques have introduced diverse vulnerabilities including Spectre, Meltdown, and microarchitectural data sampling (MDS). Although Spectre and Meltdown can leak data via memory side channels, MDS has shown to leak data from the CPU internal buffers in Intel architectures. AMD has reported that its processors are not vulnerable to MDS/Meltdown type attacks. In this paper, we present a Meltdown/MDS type of attack to leak data from the load queue in AMD Zen family architectures. To the best of our knowledge, our approach is the first attempt in developing an attack on AMD architectures using speculative load forwarding to leak data through the load queue. Experimental evaluation demonstrates that our proposed attack is successful on multiple machines with AMD processors. We also explore a lightweight mitigation to defend against speculative load forwarding attack on modern processors.

References

[1]

2019. Intel, "Microarchitectural Data Sampling / CVE-2018-12126,CVE-2018-12127,CVE-2018-12130,CVE-2019-11091/INTEL-SA-00233," 2019.

[2]

2021. AMD Product Security. https://www.amd.com/en/corporate/product-security.

[3]

2021. Transient Execution of Non-canonical Accesses. https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1010.

[4]

2021. White Paper: Software Techniques for Managing Speculation on AMD Processors. https://www.amd.com/system/files/documents/software-techniques-for-managing-speculation.pdf.

[5]

2021. White Paper: Speculation Behavior in AMD Micro Architectures. https://www.amd.com/system/files/documents/security-whitepaper.pdf.

[6]

Claudio Canella et al. 2019. Fallout: Leaking Data on Meltdown-resistant CPUs. In CCS. ACM.

[7]

Xing Fang, Jaejin Lee, and Samuel P Midkiff. 2003. Automatic fence insertion for shared memory multiprocessing. In Proceedings of the 17th annual international conference on Supercomputing. 285--294.

Digital Library

[8]

Agner Fog. 2012. The microarchitecture of Intel, AMD and VIA CPUs: An optimization guide for assembly programmers and compiler makers. Copenhagen University College of Engineering 2 (2012).

[9]

Daniel Gruss et al. 2017. Kaslr is dead: long live kaslr. In International Symposium on Engineering Secure Software and Systems. Springer, 161--176.

[10]

David Gullasch et al. 2011. Cache games-bringing access-based cache attacks on AES to practice. In S&P. IEEE, 490--505.

[11]

Gorka Irazoqui et al. 2015. S$A: A shared cache attack that works across cores and defies VM sandboxing-and its application to AES. In S&P. IEEE.

[12]

Paul Kocher et al. 2019. Spectre Attacks: Exploiting Speculative Execution. In 40th IEEE Symposium on Security and Privacy (S&P'19).

[13]

Esmaeil Mohammadian Koruyeh, Khaled N Khasawneh, Chengyu Song, and Nael Abu-Ghazaleh. 2018. Spectre returns! speculation attacks using the return stack buffer. In 12th USENIX Workshop on Offensive Technologies (WOOT 18).

Digital Library

[14]

Moritz Lipp et al. 2018. Meltdown: Reading Kernel Memory from User Space. In 27th USENIX Security Symposium (USENIX Security 18).

[15]

Yangdi Lyu and Prabhat Mishra. 2018. A survey of side-channel attacks on caches and countermeasures. Journal of Hardware and Systems Security 2, 1 (2018), 33--50.

[16]

Saidgani Musaev and Christof Fetzer. 2021. Transient Execution of Non-Canonical Accesses. arXiv preprint arXiv:2108.10771 (2021).

[17]

Zhixin Pan and Prabhat Mishra. 2021. Automated detection of spectre and meltdown attacks using explainable machine learning. In 2021 IEEE International Symposium on Hardware Oriented Security and Trust (HOST). IEEE, 24--34.

[18]

Hany Ragab, Alyssa Milburn, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida. 2021. CrossTalk: Speculative Data Leaks Across Cores Are Real. In S&P.

[19]

Michael Schwarz et al. 2019. ZombieLoad: Cross-privilege-boundary data sampling. In CCS. 753--768.

[20]

Robert M Tomasulo. 1967. An efficient algorithm for exploiting multiple arithmetic units. IBM Journal of research and Development 11, 1 (1967), 25--33.

[21]

Jo Van Bulck, Marina Minkin, Ofir Weisse, Daniel Genkin, Baris Kasikci, Frank Piessens, Mark Silberstein, Thomas F Wenisch, Yuval Yarom, and Raoul Strackx. 2018. Foreshadow: Extracting the Keys to the Intel {SGX} Kingdom with Transient {Out-of-Order} Execution. In 27th USENIX Security Symposium (USENIX Security 18). 991--1008.

[22]

Jo Van Bulck, Daniel Moghimi, Michael Schwarz, Moritz Lipp, Marina Minkin, Daniel Genkin, Yarom Yuval, Berk Sunar, Daniel Gruss, and Frank Piessens. 2020. LVI: Hijacking Transient Execution through Microarchitectural Load Value Injection. In 41th IEEE Symposium on Security and Privacy (S&P'20).

[23]

Stephan van Schaik et al. 2019. RIDL: Rogue In-flight Data Load. In S&P.

[24]

Chao Wang, Xi Li, Junneng Zhang, Xuehai Zhou, and Xiaoning Nie. 2013. MP-Tomasulo: A dependency-aware automatic parallel execution engine for sequential programs. ACM Transactions on Architecture and Code Optimization (TACO) 10, 2 (2013), 1--26.

Digital Library

[25]

Ofir Weisse, Jo Van Bulck, Marina Minkin, Daniel Genkin, Baris Kasikci, Frank Piessens, Mark Silberstein, Raoul Strackx, Thomas F Wenisch, and Yuval Yarom. 2018. Foreshadow-NG: Breaking the virtual memory abstraction with transient out-of-order execution. (2018).

[26]

Yuval Yarom and Katrina Falkner. 2014. FLUSH+ RELOAD: A high resolution, low noise, L3 cache side-channel attack. In USENIX Security. 719--732.

Cited By

Volya DZhang TAlam NTehranipoor MMishra P(2023)Towards Secure Classical-Quantum Systems2023 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)10.1109/HOST55118.2023.10133344(283-292)Online publication date: 1-May-2023
https://doi.org/10.1109/HOST55118.2023.10133344
Pan ZMishra PPan ZMishra P(2023)AI Trojan Attacks and CountermeasuresExplainable AI for Cybersecurity10.1007/978-3-031-46479-9_9(179-195)Online publication date: 28-Sep-2023
https://doi.org/10.1007/978-3-031-46479-9_9
Pan ZMishra PPan ZMishra P(2023)Mitigation of Adversarial Machine LearningExplainable AI for Cybersecurity10.1007/978-3-031-46479-9_8(163-178)Online publication date: 28-Sep-2023
https://doi.org/10.1007/978-3-031-46479-9_8
Show More Cited By

Index Terms

Speculative Load Forwarding Attack on Modern Processors
1. Security and privacy

Index terms have been assigned to the content through auto-classification.

Recommendations

An evaluation of speculative instruction execution on simultaneous multithreaded processors

Modern superscalar processors rely heavily on speculative execution for performance. For example, our measurements show that on a 6-issue superscalar, 93% of committed instructions for SPECINT95 are speculative. Without speculation, processor resources ...
The impact of speculative execution on SMT processors

By executing two or more threads concurrently, Simultaneous MultiThreading (SMT) architectures are able to exploit both Instruction-Level Parallelism (ILP) and Thread-Level Parallelism (TLP) from the increased number of in-flight instructions that are ...
Support for speculative execution in high-performance processors

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

ICCAD '22: Proceedings of the 41st IEEE/ACM International Conference on Computer-Aided Design

October 2022

1467 pages

ISBN:9781450392174

DOI:10.1145/3508352

Conference Chair:
Tulika Mitra
National University of Singapore
,
Program Chairs:
Evangeline Young
The Chinese University of Hong Kong
,
Jinjun Xiong
University at Buffalo (UB)

Copyright © 2022 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGDA: ACM Special Interest Group on Design Automation

In-Cooperation

IEEE-EDS: Electronic Devices Society
IEEE CAS
IEEE CEDA

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 22 December 2022

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Qualifiers

Research-article

Funding Sources

Semiconductor Research Corporation

Conference

ICCAD '22

Sponsor:

SIGDA

ICCAD '22: IEEE/ACM International Conference on Computer-Aided Design

October 30 - November 3, 2022

California, San Diego

Acceptance Rates

Overall Acceptance Rate 457 of 1,762 submissions, 26%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

7
Total Citations
View Citations
158
Total Downloads

Downloads (Last 12 months)33
Downloads (Last 6 weeks)2

Reflects downloads up to 28 Feb 2025

Other Metrics

View Author Metrics

Citations

Cited By

Volya DZhang TAlam NTehranipoor MMishra P(2023)Towards Secure Classical-Quantum Systems2023 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)10.1109/HOST55118.2023.10133344(283-292)Online publication date: 1-May-2023
https://doi.org/10.1109/HOST55118.2023.10133344
Pan ZMishra PPan ZMishra P(2023)AI Trojan Attacks and CountermeasuresExplainable AI for Cybersecurity10.1007/978-3-031-46479-9_9(179-195)Online publication date: 28-Sep-2023
https://doi.org/10.1007/978-3-031-46479-9_9
Pan ZMishra PPan ZMishra P(2023)Mitigation of Adversarial Machine LearningExplainable AI for Cybersecurity10.1007/978-3-031-46479-9_8(163-178)Online publication date: 28-Sep-2023
https://doi.org/10.1007/978-3-031-46479-9_8
Pan ZMishra PPan ZMishra P(2023)Hardware Trojan Detection Using Shapley Ensemble BoostingExplainable AI for Cybersecurity10.1007/978-3-031-46479-9_7(141-159)Online publication date: 28-Sep-2023
https://doi.org/10.1007/978-3-031-46479-9_7
Pan ZMishra PPan ZMishra P(2023)Malware Detection Using Explainable AIExplainable AI for Cybersecurity10.1007/978-3-031-46479-9_3(55-73)Online publication date: 28-Sep-2023
https://doi.org/10.1007/978-3-031-46479-9_3
Pan ZMishra PPan ZMishra P(2023)Explainable AI Acceleration Using Tensor Processing UnitsExplainable AI for Cybersecurity10.1007/978-3-031-46479-9_11(221-232)Online publication date: 28-Sep-2023
https://doi.org/10.1007/978-3-031-46479-9_11
Pan ZMishra PPan ZMishra P(2023)Hardware Acceleration of Explainable AIExplainable AI for Cybersecurity10.1007/978-3-031-46479-9_10(199-220)Online publication date: 28-Sep-2023
https://doi.org/10.1007/978-3-031-46479-9_10

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten