Timing side-channel attacks and countermeasures in CPU microarchitectures

J Zhang, C Chen, J Cui, K Li - ACM Computing Surveys, 2024‏ - dl.acm.org
Microarchitectural vulnerabilities, such as Meltdown and Spectre, exploit subtle
microarchitecture state to steal the user's secret data and even compromise the operating …

RIDL: Rogue in-flight data load

S Van Schaik, A Milburn, S Österlund… - … IEEE Symposium on …, 2019‏ - ieeexplore.ieee.org
We present Rogue In-flight Data Load (RIDL), a new class of speculative unprivileged and
constrained attacks to leak arbitrary data across address spaces and privilege boundaries …

Spectre attacks: Exploiting speculative execution

P Kocher, J Horn, A Fogh, D Genkin, D Gruss… - Communications of the …, 2020‏ - dl.acm.org
Modern processors use branch prediction and speculative execution to maximize
performance. For example, if the destination of a branch depends on a memory value that is …

Meltdown: Reading kernel memory from user space

M Lipp, M Schwarz, D Gruss, T Prescher… - Communications of the …, 2020‏ - dl.acm.org
Meltdown: reading kernel memory from user space Page 1 46 COMMUNICATIONS OF THE
ACM | JUNE 2020 | VOL. 63 | NO. 6 contributed articles IMA GE B Y ANDRIJ BOR YS A …

Fallout: Leaking data on meltdown-resistant cpus

C Canella, D Genkin, L Giner, D Gruss, M Lipp… - Proceedings of the …, 2019‏ - dl.acm.org
Meltdown and Spectre enable arbitrary data leakage from memory via various side
channels. Short-term software mitigations for Meltdown are only a temporary solution with a …

Meltdown

M Lipp, M Schwarz, D Gruss, T Prescher… - arxiv preprint arxiv …, 2018‏ - arxiv.org
The security of computer systems fundamentally relies on memory isolation, eg, kernel
address ranges are marked as non-accessible and are protected from user access. In this …

[HTML][HTML] A survey on the (in) security of trusted execution environments

A Muñoz, R Ríos, R Román, J López - Computers & Security, 2023‏ - Elsevier
As the number of security and privacy attacks continue to grow around the world, there is an
ever increasing need to protect our personal devices. As a matter of fact, more and more …

Translation leak-aside buffer: Defeating cache side-channel protections with {TLB} attacks

B Gras, K Razavi, H Bos, C Giuffrida - 27th USENIX Security Symposium …, 2018‏ - usenix.org
To stop side channel attacks on CPU caches that have allowed attackers to leak secret
information and break basic security mechanisms, the security community has developed a …

ret2spec: Speculative execution using return stack buffers

G Maisuradze, C Rossow - Proceedings of the 2018 ACM SIGSAC …, 2018‏ - dl.acm.org
Speculative execution is an optimization technique that has been part of CPUs for over a
decade. It predicts the outcome and target of branch instructions to avoid stalling the …

{ScatterCache}: thwarting cache attacks via cache set randomization

M Werner, T Unterluggauer, L Giner… - 28th USENIX Security …, 2019‏ - usenix.org
Cache side-channel attacks can be leveraged as a building block in attacks leaking secrets
even in the absence of software bugs. Currently, there are no practical and generic …