PACMAN: attacking ARM pointer authentication with speculative execution

J Ravichandran, WT Na, J Lang, M Yan - Proceedings of the 49th …, 2022‏ - dl.acm.org
This paper studies the synergies between memory corruption vulnerabilities and speculative
execution vulnerabilities. We leverage speculative execution attacks to bypass an important …

{InSpectre} Gadget: Inspecting the Residual Attack Surface of Cross-privilege Spectre v2

S Wiebing, A de Faveri Tron, H Bos… - 33rd USENIX Security …, 2024‏ - usenix.org
Spectre v2 is one of the most severe transient execution vulnerabilities, as it allows an
unprivileged attacker to lure a privileged (eg, kernel) victim into speculatively jum** to a …

Transient-execution attacks: A computer architect perspective

L Fiolhais, L Sousa - ACM Computing Surveys, 2023‏ - dl.acm.org
Computer architects employ a series of performance optimizations at the micro-architecture
level. These optimizations are meant to be invisible to the programmer but they are implicitly …

Rega: Scalable rowhammer mitigation with refresh-generating activations

M Marazzi, F Solt, P Jattke, K Takashi… - 2023 IEEE Symposium …, 2023‏ - ieeexplore.ieee.org
Mitigating Rowhammer requires performing additional refresh operations to recharge DRAM
rows before bits start to flip. These refreshes are scarce and can only happen periodically …

I see dead µops: Leaking secrets via intel/amd micro-op caches

X Ren, L Moody, M Taram, M Jordan… - 2021 ACM/IEEE 48th …, 2021‏ - ieeexplore.ieee.org
Modern Intel, AMD, and ARM processors translate complex instructions into simpler internal
micro-ops that are then cached in a dedicated on-chip structure called the micro-op cache …

Going beyond the limits of sfi: Flexible and secure hardware-assisted in-process isolation with hfi

S Narayan, T Garfinkel, M Taram, J Rudek… - Proceedings of the 28th …, 2023‏ - dl.acm.org
We introduce Hardware-assisted Fault Isolation (HFI), a simple extension to existing
processors to support secure, flexible, and efficient in-process isolation. HFI addresses the …

SoK: Practical foundations for software Spectre defenses

S Cauligi, C Disselkoen, D Moghimi… - … IEEE Symposium on …, 2022‏ - ieeexplore.ieee.org
Spectre vulnerabilities violate our fundamental assumptions about architectural abstractions,
allowing attackers to steal sensitive data despite previously state-of-the-art …

Ultimate {SLH}: Taking speculative load hardening to the next level

Z Zhang, G Barthe, C Chuengsatiansup… - 32nd USENIX Security …, 2023‏ - usenix.org
In this paper we revisit the Spectre v1 vulnerability and software-only countermeasures.
Specifically, we systematically investigate the performance penalty and security properties of …

[PDF][PDF] Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel.

B Johannesmeyer, J Koschel, K Razavi, H Bos… - NDSS, 2022‏ - download.vusec.net
Due to the high cost of serializing instructions to mitigate Spectre-like attacks on
mispredicted conditional branches (Spectre-PHT), developers of critical software such as the …

AfterImage: Leaking control flow data and tracking load operations via the hardware prefetcher

Y Chen, L Pei, TE Carlson - Proceedings of the 28th ACM International …, 2023‏ - dl.acm.org
Research into processor-based side-channels has seen both a large number and a large
variety of disclosed vulnerabilities that can leak critical, private data to malicious attackers …