Specularizer : Detecting Speculative Execution Attacks via Performance Tracing

Abstract

This paper presents Specularizer, a framework for uncovering speculative execution attacks using performance tracing features available in commodity processors. It is motivated by the practical difficulty of eradicating such vulnerabilities in the design of CPU hardware and operating systems and the principle of defense-in-depth. The key idea of Specularizer is the use of Hardware Performance Counters and Processor Trace to perform lightweight monitoring of production applications and the use of machine learning techniques for identifying the occurrence of the attacks during offline forensics analysis. Different from prior works that use performance counters to detect side-channel attacks, Specularizer monitors triggers of the critical paths of the speculative execution attacks, thus making the detection mechanisms robust to different choices of side channels used in the attacks. To evaluate Specularizer, we model all known types of exception-based and misprediction-based speculative execution attacks and automatically generate thousands of attack variants. Experimental results show that Specularizer yields superior detection accuracy and the online tracing of Specularizer incur reasonable overhead.

Exploiting Hardware from Software

“…For instance, in BHI we rely on eBPF for our user-to-kernel exploit because finding exploitable Spectre-v2 gadgets in the kernel is a very complex task (as discussed in Chapter 6.6.4). Prior work has developed different solutions for finding possible gadgets [110,145,297,298]. Yet, little has been done towards analyzing their exploitability.…”