CPU Port Contention Without SMT

Abstract

CPU port contention has been used in the last years as a stateless side channel to perform side-channel attacks and transient execution attacks. One drawback of this channel is that it heavily relies on simultaneous multi-threading, which can be absent from some CPUs or simply disabled by the OS. In this paper, we present sequential port contention, which does not require SMT. It exploits sub-optimal scheduling to execution ports for instruction-level parallelization. As a result, specifically-crafted instruction sequences on a single thread suffer from an increased latency. We show that sequential port contention can be exploited from web browsers in WebAssembly. We present an automated framework to search for instruction sequences leading to sequential port contention for specific CPU generations, which we evaluated on 50 different CPUs. An attacker can use these sequences from the browser to determine the CPU generation within 12 s with a 95 % accuracy. This fingerprint is highly stable and resistant to system noise, and we show that mitigations are either expensive or only probabilistic.

The Finger in the Power: How to Fingerprint PCs by Monitoring Their Power Consumption

“…State of the art of hardware fingerprinting mechanisms focuses on detecting static CPU properties, such as the cache size or micro-architectural generation [40,29] or on the relative speed of the machine's underlying components [32,19]. This work, in contrast, focuses on the power consumption of the CPU -we assume that, due to slight manufacturing differences in the hardware, the power consumption is slightly different between each device.…”

“…We believe that this increases the robustness of our system. Rokicki et al [29] used WebAssembly instructions as a fingerprinting method, creating a method for detecting hardware processor generation based on the processor's lookahead buffer behavior. Laor et al [19] showed that it is possible to fingerprint systems based on the individual execution units found inside their Graphical Processing Units (GPUs).…”

“…Hardware attributes can fall into either of two categories. Discrete attributes are classified in pre-determined categories, such as the number of physical cores [40] or CPU generation [29]. As many users share the same hardware model, these attributes do not yield a high uniqueness, but their identification is often stable.…”