Download as PDF, PPTX
![MeltdownMeltdown
➢ Exploiting the out-of-order execution
1. you need code like this(where i is 200000):
if (array[i] < 200) a = i+b;
else a = array[i];
2. speculative execution will cause the CPU to
execute both the if and the else blocks
3. clear the CPU cache (clflush() will do the job)
4. execute your tool and read all the cache
5. Bytes that are fetched into the cache will be
faster to read then bytes that are NOT](https://image.slidesharecdn.com/meltdown-180223082451/75/Meltdown-Spectre-attacks-3-2048.jpg)
![MeltdownMeltdown
➢ Because of out-of-order execution
1. The memory pointed by array[i] will be
fetched by the CPU into the L3 cache
2. but because array[i] points to memory
address outside the processes region, it will die
with SIGSEGV
3. Now the parent, can examine all the memory of
the child and it does so by timing every read from
memory
4. Data that is in the cache is faster to read :)](https://image.slidesharecdn.com/meltdown-180223082451/75/Meltdown-Spectre-attacks-4-2048.jpg)
![Spectre Variant 1Spectre Variant 1
struct array { u_long length; u_char data[]; };
struct array *arr1 = ...; // small array
struct array *arr2 = ...; // array of size 0x400
// >0x400 (OUT OF BOUNDS!)
u_long u = untrusted_offset_from caller;
if (u < arr1->length) {
u_char val = arr1->data[u];
u_long i2 = ((val&1)*0x100)+0x200;
if (index2 < arr2->length) {
unsigned char val2 = arr2->data[i2];
}
}](https://image.slidesharecdn.com/meltdown-180223082451/75/Meltdown-Spectre-attacks-8-2048.jpg)
Uploaded byMarian Marinov
Meltdown & Spectre attacks
The document discusses the Meltdown and Spectre attacks, which exploit side channels and speculative execution in modern processors. Meltdown allows reading privileged memory via out-of-order execution. Spectre uses branch prediction to induce mispeculation that leaks data. Mitigations include kernel page table isolation for Meltdown and techniques like Retpoline, IBRS, and IBPB to restrict speculation for Spectre variants 1 and 2. Future exploits may target SIMD and larger registers with more advanced prediction.
More Related Content
Meltdown & Spectre attacks
- 1. MeltdownMeltdown andand SpectreSpectre attacksattacks Marian MarinovMarian Marinov mm@siteground.commm@siteground.com ChiefSystem ArchitectChief System Architect Head of the DevOps departmentHead of the DevOps department
- 2. Some attacks firstSome attacks first ➢ Timing attacks ➢Side channel attacks
- 3. MeltdownMeltdown ➢ Exploiting theout-of-order execution 1. you need code like this(where i is 200000): if (array[i] < 200) a = i+b; else a = array[i]; 2. speculative execution will cause the CPU to execute both the if and the else blocks 3. clear the CPU cache (clflush() will do the job) 4. execute your tool and read all the cache 5. Bytes that are fetched into the cache will be faster to read then bytes that are NOT
- 4. MeltdownMeltdown ➢ Because ofout-of-order execution 1. The memory pointed by array[i] will be fetched by the CPU into the L3 cache 2. but because array[i] points to memory address outside the processes region, it will die with SIGSEGV 3. Now the parent, can examine all the memory of the child and it does so by timing every read from memory 4. Data that is in the cache is faster to read :)
- 5. SpectreSpectre ➢ Variant 1 ➢Variant 2
- 6. SpectreSpectre ➢ Variant 1 ➢Exploiting Conditional Branches ➢ Variant 2
- 7. SpectreSpectre ➢ Variant 1 ➢Exploiting Conditional Branches ➢ Variant 2 ➢ Pre-training the branch predictor
- 8. Spectre Variant 1Spectre Variant 1 struct array {u_long length; u_char data[]; }; struct array *arr1 = ...; // small array struct array *arr2 = ...; // array of size 0x400 // >0x400 (OUT OF BOUNDS!) u_long u = untrusted_offset_from caller; if (u < arr1->length) { u_char val = arr1->data[u]; u_long i2 = ((val&1)*0x100)+0x200; if (index2 < arr2->length) { unsigned char val2 = arr2->data[i2]; } }
- 9. Spectre Variant 2Spectre Variant 2 ➢ Simply trainthe branch predictor to mispredict a condition ➢ Then read the memory and time the reads.
- 10. Spectre attacksSpectre attacks ➢ Both Spectrevulnerabilities require that the attacking code is running on the same core or hyper-thread on that core in order to be exploited
- 11. History branch predictionHistory branch prediction ➢ 1991 Two-leveladaptive training branch prediction ➢ 1998 Research on Neural Branch Predictors ➢ 2001 Dynamic branch prediction with perceptrons ➢ 2016 Perceptron learning for reuse prediction
- 12. History Cache attacksHistory Cache attacks ➢ 2005 Cachemissing for fun and profit ➢ 2013 Practical Timing Side Channel Attacks ➢ 2014 Just a Little Bit ➢ 2014 Flush+Reload ➢ 2015 Cache Template Attacks ➢ 2015 Last-Level Cache Side-Channel Attacks are Practical ➢ 2016 Prefetch Side-Channel Attacks ➢ 2016 Flush+Flush ➢ 2016 Breaking KASLR with TSX ➢ 2017 Practical Cache Attacks on the MMU
- 13.
- 14.
- 15.
- 16. Now, some backgroundNow, some background Shared L3 Cache(LLC) Synchronization L1 Instruction cache Branch Predict.Isnt. Fetch Pipeline(s) Instruction decoder Dispatch Integer Cluster 2FPU W.C. Cache L1 Instruction cache L1 data cache Integer Cluster 1 L1 data cache L2 Data Cache shared Core Iface Single Core L1 Instruction cache Branch Predict.Isnt. Fetch Pipeline(s) Instruction decoder Dispatch Integer Cluster 2FPU W.C. Cache L1 Instruction cache L1 data cache Integer Cluster 1 L1 data cache L2 Data Cache shared Core Iface Single Core L1 Instruction cache Ins L1 Instruction cache Integer Cluster 1 L1 data cache Core Iface AMD Bulldozer block diagram
- 17. Now, some backgroundNow, some background Shared L3 Cache(LLC) Synchronization L1 Instruction cache Branch Predict.Isnt. Fetch Pipeline(s) Instruction decoder Dispatch Integer Cluster 2FPU W.C. Cache L1 Instruction cache L1 data cache Integer Cluster 1 L1 data cache L2 Data Cache shared Core Iface Single Core L1 Instruction cache Branch Predict.Isnt. Fetch Pipeline(s) Instruction decoder Dispatch Integer Cluster 2FPU W.C. Cache L1 Instruction cache L1 data cache Integer Cluster 1 L1 data cache L2 Data Cache shared Core Iface Single Core L1 Instruction cache Ins L1 Instruction cache Integer Cluster 1 L1 data cache Core Iface AMD Bulldozer block diagram
- 18. Now, some backgroundNow, some background Shared L3 Cache(LLC) Synchronization L1 Instruction cache Branch Predict.Isnt. Fetch Pipeline(s) Instruction decoder Dispatch Integer Cluster 2FPU W.C. Cache L1 Instruction cache L1 data cache Integer Cluster 1 L1 data cache L2 Data Cache shared Core Iface Single Core L1 Instruction cache Branch Predict.Isnt. Fetch Pipeline(s) Instruction decoder Dispatch Integer Cluster 2FPU W.C. Cache L1 Instruction cache L1 data cache Integer Cluster 1 L1 data cache L2 Data Cache shared Core Iface Single Core L1 Instruction cache Ins L1 Instruction cache Integer Cluster 1 L1 data cache Core Iface AMD Bulldozer block diagram
- 19. Now, some backgroundNow, some background Floating Point L1 D-CacheD-TLB Schedulers Integer μop queues Decoder Trace Cache Rename/Alloc μop ROMBTB BTB and I-TLB BusL2CacheandControl
- 20. Now, some backgroundNow, some background Floating Point L1 D-CacheD-TLB Schedulers Integer μop queues Decoder Trace Cache Rename/Alloc μop ROMBTB BTB and I-TLB BusL2CacheandControl Thread 1: floating point
- 21. Now, some backgroundNow, some background Floating Point L1 D-CacheD-TLB Schedulers Integer μop queues Decoder Trace Cache Rename/Alloc μop ROMBTB BTB and I-TLB BusL2CacheandControl Thread 1: integer
- 22. Now, some backgroundNow, some background Floating Point L1 D-CacheD-TLB Schedulers Integer μop queues Decoder Trace Cache Rename/Alloc μop ROMBTB BTB and I-TLB BusL2CacheandControl Thread 1: integer Thread 2: floating point
- 23. Meltdown mitigationMeltdown mitigation ➢ Protection ➢ KernelPage Table Isolation kernel space user space All memory
- 24. Meltdown Meltdown mitigationmitigation ➢ Protection ➢ KernelPage Table Isolation kernel space user space All memory
- 25.
- 26. Spectre Spectre MitigationsMitigations ➢ Indirect BranchRestricted Speculation (IBRS) ➢ Single Thread Indirect Branch Predictors (STIBP) ➢ Indirect Branch Predictor Barrier (IBPB) Variant 2Variant 2
- 27. Spectre Spectre MitigationsMitigations ➢ Indirect BranchRestricted Speculation (IBRS) ➢ disable branch prediction ➢ Single Thread Indirect Branch Predictors (STIBP) ➢ Indirect Branch Predictor Barrier (IBPB) Variant 2Variant 2
- 28. Spectre Spectre MitigationsMitigations ➢ Indirect BranchRestricted Speculation (IBRS) ➢ disable branch prediction ➢ Single Thread Indirect Branch Predictors (STIBP) ➢ isolate the predictions to hyper-thread ➢ Indirect Branch Predictor Barrier (IBPB) Variant 2Variant 2
- 29. Spectre Spectre MitigationsMitigations ➢ Indirect BranchRestricted Speculation (IBRS) ➢ disable branch prediction ➢ Single Thread Indirect Branch Predictors (STIBP) ➢ isolate the predictions to hyper-thread ➢ Indirect Branch Predictor Barrier (IBPB) ➢ prevent user space predictions to leak to kernel space (on every context switch) Variant 2Variant 2
- 30. Expect more exploitsExpect more exploits ➢ SIMD -Single Instruction Multiple Data ➢ MIMD - Multiple Instructions Multiple Data ➢ Larger Registers with larger branch predictors ➢ SSE*, AVX, AVX256, AVX512
- 31.