A Fetching Tale: Covert Communication with the Hardware Prefetcher

Cronin, Patrick; Yang, Chengmo

doi:10.1109/hst.2019.8741033

Cited by 13 publications

(10 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…When we reload a shared page, instead of loading the cache line sequentially, we use the modern version of the Fisher-Yates shuffle algorithm [16] to randomize the index sequence in the searching range (i.e., [0,63]). In addition, we add mfence and lfence when we measure the memory instruction execution time to ensure that measured memory and cache access time is accurate [14].…”

Section: Methodsmentioning

confidence: 99%

“…Haswell, a newer generation microarchitecture, uses enhanced data prefetchers [25], but the details of these updates remain undocumented. Prior works [14,51,59] have attempted to reverse-engineer a number of the characteristics of the Intel IP-stride prefetcher. However, in this work, we take an additional step to reverse-engineer the major components of the IP-stride prefetcher in the Haswell and Coffee Lake microarchitectures.…”

Section: Understanding Intel's Ip-stride Prefetchermentioning

confidence: 99%

“…Modern processors often use virtual memory management with memory paging support. According to previous studies [14,25], when an instruction loads data (current address) from a new page, the prefetcher invalidates the entry and will need to re-learn the stride. To understand how cross-page accesses affect this prefetcher in newer generations, and to allow AfterImage to be applied to a broad set of scenarios across different execution contexts, we next broaden our investigation to reverse-engineer the undocumented elements of the page checking policy.…”

Section: Page Boundary Checkingmentioning

confidence: 99%

“…Hardware prefetchers have also been investigated as a potential side-channel and covert channel, expanding this list of vulnerable hardware structures [14,51]. Prefetchers work by preloading data into the cache before it is requested by the processor to mitigate the effects of extremely long DRAM load latencies.…”

Section: Introductionmentioning

confidence: 99%

“…table look-ups, and is not a general side-channel. One subsequent work [14] developed a covert channel with the use of the IP-stride prefetcher. By iteratively training and evicting the recently trained entries, the sender and the receiver were able to communicate with each other.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Leaking Control Flow Information via the Hardware Prefetcher

Chen,

Pei,

Carlson

2021

Preprint

View full text Add to dashboard Cite

Modern processor designs use a variety of microarchitectural methods to achieve high performance. Unfortunately, new side-channels have often been uncovered that exploit these enhanced designs. One area that has received little attention from a security perspective is the processor's hardware prefetcher, a critical component used to mitigate DRAM latency in today's systems. Prefetchers, like branch predictors, hold critical state related to the execution of the application, and have the potential to leak secret information. But up to now, there has not been a demonstration of a generic prefetcher side-channel that could be actively exploited in today's hardware.In this paper, we present AfterImage, a new side-channel that exploits the Intel Instruction Pointer-based stride prefetcher. We observe that, when the execution of the processor switches between different private domains, the prefetcher trained by one domain can be triggered in another. To the best of our knowledge, this work is the first to publicly demonstrate a methodology that is both algorithm-agnostic and also able to leak kernel data into userspace. AfterImage is different from previous works, as it leaks data on the non-speculative path of execution. Because of this, a large class of work that has focused on protecting transient, branch-outcome-based data will be unable to block this side-channel. By reverse-engineering the IP-stride prefetcher in modern Intel processors, we have successfully developed three variants of AfterImage to leak control flow information across code regions, processes and the user-kernel boundary. We find a high level of accuracy in leaking information with our methodology (from 91%, up to 99%), and propose two mitigation techniques to block this side-channel, one of which can be used on hardware systems today.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Understanding Intel's Ip-stride Prefetchermentioning

confidence: 99%

Section: Page Boundary Checkingmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Leaking Control Flow Information via the Hardware Prefetcher

Chen,

Pei,

Carlson

2021

Preprint

View full text Add to dashboard Cite

show abstract

A Survey on Cache Timing Channel Attacks for Multicore Processors

Kaur

Das

2021

J Hardw Syst Secur

View full text Add to dashboard Cite

Cache timing channel attacks has attained a lot of attention in the last decade. These attacks exploits the timing channel created by the significant time gap between cache and main memory accesses. It has been successfully implemented to leak the secret key of various cryptography algorithms. The latest advancements in cache attacks also exploit other microarchitectural components such as hardware prefetchers, branch predictor, and replacement engine, in addition to the cache memory. Detection of these attacks is a difficult task as the attacker process running in the processor must be detected before significant portion of the attack is complete. The major challenge for mitigation and defense mechanisms against these attacks is maintaining the system performance while disabling or avoiding these attacks. The overhead caused by detection, mitigation and defense mechanism must not be significant to system's performance. This paper discusses the research carried out in three aspects of cache security: cache timing channel attacks, detection techniques of these attacks, and defense mechanisms in details. KeywordsCache security • Cache timing channel attack • Side-channel attack • Covert channel attack • Detection techniques • Defense mechanisms

show abstract

Microarchitectural Side-Channel Threats, Weaknesses and Mitigations: A Systematic Mapping Study

2023

View full text Add to dashboard Cite

Over the course of recent years, microarchitectural side-channel attacks emerged as one of the most novel and thought-provoking attacks to exfiltrate information from computing hardware. These attacks leverage the unintended artefacts produced as side-effects to certain architectural design choices and proved difficult to be effectively mitigated without incurring significant performance penalties. In this work, we undertake a systematic mapping study of the academic literature related to the aforementioned attacks. We, in particular, pose four research questions and study 104 primary works to answer those questions. We inquire about the origins of artefacts leading up to exploitable settings of microarchitectural side-channel attacks; the effectiveness of the proposed countermeasures; and the lessons to be learned that would help build secure systems for the future. Furthermore, we propose a classification scheme that would also serve in the future for systematic mapping efforts in this scope.

show abstract

A Fetching Tale: Covert Communication with the Hardware Prefetcher

Cited by 13 publications

References 17 publications

Leaking Control Flow Information via the Hardware Prefetcher

Leaking Control Flow Information via the Hardware Prefetcher

A Survey on Cache Timing Channel Attacks for Multicore Processors

Microarchitectural Side-Channel Threats, Weaknesses and Mitigations: A Systematic Mapping Study

Contact Info

Product

Resources

About