This document discusses microarchitectural attacks like Meltdown and Spectre. It defines microarchitectural attacks as exploiting transient instructions that can change CPU state to leak information via covert channels. Meltdown specifically targets Intel processors by leveraging out-of-order execution to access privileged memory, while Spectre works across CPUs by mispredicting branches. The document outlines the technical details and variations of the different attacks as well as resources to explore them further.

1. Wonderful world of Microarchitectural attacks
Toshihito Kikuchi
Feb-26-2018
1

2. Agenda
 What is Microarchitectural attack?
 What is Meltdown/Spectre and how different?
 Rogue data cache load (Meltdown: CVE-2017-5754)
 Flush+Reload technique
 Bounds Check Bypass (Spectre #1: CVE-2017-5753)
 Branch Target Injection (Spectre #2: CVE-2017-5715)
2

3. What is Microarchitectural attack?
 New type of attack, totally different from BOR, UAF, etc.
 CPU executes codes speculatively to increase performance
 Transient instructions can change microarchitectural state
 Microarchitectural state can be transferred into
architectural state using known covert channels
 Flush+Reload (most accurate known cache side channel and is simple to implement)
 Evict+Time
 Prime+Probe
3

4. Example: Intel's Skylake microarchitecture
4

5. What is Microarchitectual attack?
 Terminology
 In this paper, we refer to speculative execution in a more
restricted meaning, where it refers to an instruction sequence
following a branch, and use the term out-of-order execution to
refer to any way of getting an operation executed before the
processor has committed the results of all prior instructions.
5

6. What is Meltdown/Spectre and how different?
 Meltdown
 exploits side effects caused by out-of-order execution, and
privilege escalation vulnerability specific to Intel processors
 can be mitigated by KPTI (aka KAISER)
 Spectre
 exploits side effects caused by conditional branch misprediction
 works on AMD and ARM as well
 can violate process isolation boundaries (depending on the victim's
binary layout, though)
 lots of theoretical variations
 harder to exploit, but harder to mitigate, too
6
KPTI = Kernel Page-Table Isolation
KAISER = Kernel Address Isolation to have Side-channels Efficiently Removed (https://github.com/IAIK/KAISER)

7. Rogue data cache load (Meltdown)
 Core instruction sequence:
7
1. retry:
2. mov al, byte [target_kernel_address]
3. shl rax, 0xc
4. jz retry
5. mov rbx, qword [probe_array + rax]

8. Flush+Reload
 Implementation example:
8
1. flush_reload:
2. mov r9, rcx
3. rdtscp
4. shl rdx, 20h
5. or rax, rdx
6. mov r8, rax
7. mov rax, [r9]
8. rdtscp
9. shl rdx, 20h
10. or rax, rdx
11. clflush [r9]
12. sub rax,r8
13. ret
The RDTSC instruction is not a serializing instruction. It does not
necessarily wait until all previous instructions have been executed
before reading the counter. Similarly, subsequent instructions may
begin execution before the read operation is performed. If software
requires RDTSC to be executed only after all previous instructions have
completed locally, it can either use RDTSCP (if the processor supports
that instruction) or execute the sequence LFENCE;RDTSC.
The RDTSCP instruction waits until all previous instructions have been
executed before reading the counter. However, subsequent instructions
may begin execution before the read operation is performed.
Intel® 64 and IA-32 Architectures Software Developer’s Manual

9. Bounds Check Bypass (Spectre #1)
 Core instruction sequence:
9
1. cmp target, dword [comparer]
2. jae skip
3. mov al, byte [array + target]
4. shl rax, 0xc
5. mov rax, qword [probe + rax]
6. skip:
7. ret

10. Branch Target Injection (Spectre #2)
 It is possible for code in separate security contexts to
influence each other's branch prediction
 Attacker's process can train Victim's process to cause
misprediction
 Not observed positive results yet. Stay tuned.
10

11. Explore more..
 GPZ's post that opened Pandora's Box:
https://googleprojectzero.blogspot.com/2018/01/reading-
privileged-memory-with-side.html
 The portal site:
https://meltdownattack.com/
https://spectreattack.com/
 Official Meltdown PoC:
https://github.com/IAIK/meltdown
 Earlier effort of Meltdown (negative result):
https://cyber.wtf/2017/07/28/negative-result-reading-kernel-
memory-from-user-mode/
 My PoC for Windows:
https://github.com/msmania/microarchitectural-attack
11