"It's a Trap!"-How Speculation Invariance Can Be Abused with Forward Speculative Interference

Abstract

Side-channel attacks based on speculative execution access sensitive data and use transmitters to leak such data during wrongpath execution. Speculative side-channel defenses have been proposed to prevent such information leakage. In one class of defenses, speculative instructions are considered unsafe and are delayed until they become non-speculative.However, not all speculative instructions are unsafe: Recent work demonstrates that speculative invariant instructions are independent of a speculative control-flow path and are guaranteed to eventually execute and commit, regardless of the outcome of the performed speculation. Compile time information coupled with run-time mechanisms can then selectively lift defenses for Speculative Invariant instructions, regaining some of the performance lost to "delay" defenses.Unfortunately, speculative invariance can be easily mishandled with Speculative Interference to leak information using a new side-channel that we introduce in this paper. Recent work shows that younger speculative instructions can interfere with older non-speculative instructions that are bound to commit. This "backward" speculative interference reveals speculatively accessed secrets through the non-speculative instructions, in a way that delay-defenses do not cover, rendering them ineffective for this type of attack.In our work, we show that the counterpart to backward speculative interference, i.e., forward speculative interference, enables older speculative instructions to interfere with younger speculative-invariant (bound-tocommit) instructions, effectively turning them into transmitters for secret data accessed during speculation. We demonstrate forward speculative interference on real hardware, by selectively filling the reorder buffer (ROB) with spurious instructions, pushing speculative-invariant instructions inor-out the ROB on demand, based on a speculatively accessed secret. This reveals the speculatively accessed secret, as the occupancy of the ROB itself becomes a new speculative side-channel. We also demonstrate that it is possible to use the x86 ISA REP prefix, which unrolls as a micro-op loop in the microarchitecture at decode time (before any sidechannel defenses have taken effect), as a method for generating spurious instructions. We propose several mitigations that range from changing compile-time decisions for speculative-invariance to run-time mechanisms that aim to make ROB occupancy operand-independent.