CacheQuery: Learning Replacement Policies from Hardware Caches

Vila, Pepe; Ganty, Pierre; Guarnieri, Marco; Köpf, Boris

doi:10.48550/arxiv.1912.09770

Cited by 2 publications

(4 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The replacement policy described in [10] agrees with the ones described in [3,62] in the selection of the eviction candidate most of the times. Indeed, our attack can be explained considering any of them as the correct one.…”

Section: Replacement Policy and Accurate Eviction Of Datamentioning

confidence: 58%

“…It turns out that Intel implements a tree based Pseudo-LRU replacement policy in the low level caches. Independently and concurrently with the design of this attack, some other researchers arrived to the same conclusion [3,62].…”

Section: Influence Of the Replacement Policy Of The L1 Cachesmentioning

confidence: 70%

“…Later studies [28,63] have focused on eviction strategies related to maximize the number of evictions in order to improve memory attacks. Recently, the replacement policy of all the cache levels of modern Intel processors have been reverse engineered and published [3,10,62].…”

Section: Replacement Policiesmentioning

confidence: 99%

See 2 more Smart Citations

CACHE SNIPER : Accurate timing control of cache evictions

Briongos,

Bruhns,

Malagón

et al. 2020

Preprint

View full text Add to dashboard Cite

Microarchitectural side channel attacks have been very prominent in security research over the last few years. Caches have been an outstanding covert channel, as they provide high resolution and generic cross-core leakage even with simple user-mode code execution privileges. To prevent these generic cross-core attacks, all major cryptographic libraries now provide countermeasures to hinder key extraction via cross-core cache attacks, for instance avoiding secret dependent access patterns and prefetching data. In this paper, we show that implementations protected by 'good-enough' countermeasures aimed at preventing simple cache attacks are still vulnerable. We present a novel attack that uses a special timing technique to determine when an encryption has started and then evict the data precisely at the desired instant. This new attack does not require special privileges nor explicit synchronization between the attacker and the victim.One key improvement of our attack is a method to evict data from the cache with a single memory access and in absence of shared memory by leveraging the transient capabilities of TSX and relying on the recently reverse-engineered L3 replacement policy. We demonstrate the efficiency by performing an asynchronous last level cache attack to extract an RSA key from the latest wolfSSL library, which has been especially adapted to avoid leaky access patterns, and by extracting an AES key from the S-Box implementation included in OpenSSL bypassing the per round prefetch intended as a protection against cache attacks.

show abstract

Section: Replacement Policy and Accurate Eviction Of Datamentioning

confidence: 58%

Section: Influence Of the Replacement Policy Of The L1 Cachesmentioning

confidence: 70%

See 1 more Smart Citation

CACHE SNIPER : Accurate timing control of cache evictions

Briongos,

Bruhns,

Malagón

et al. 2020

Preprint

View full text Add to dashboard Cite

show abstract

“…To identify the replacement policy on our machine, we used a CacheAnalyzer tool by nanoBench [3]. The resulting replacement policy is approximately QLRU_H11_M1_R0_U0 ("Quad-age LRU") on specific cache sets [51]. 4 QLRU is a Static-RRIP Replacement policy variant with a 2 bit field used for the age of a cache line [3,24], summed up here: lines until there is a candidate ready for eviction (age = 3).…”

Section: Receiver (Monitoring Replacement State)mentioning

confidence: 99%

Speculative Interference Attacks: Breaking Invisible Speculation Schemes

Behnia¹,

Sahu²,

Paccagnella³

et al. 2020

Preprint

View full text Add to dashboard Cite

Recent security vulnerabilities that target speculative execution (e.g., Spectre) present a significant challenge for processor design. The highly publicized vulnerability uses speculative execution to learn victim secrets by changing the cache state. As a result, recent computer architecture research has focused on invisible speculation mechanisms that attempt to block changes in cache state due to speculative execution. Prior work has shown significant success in preventing Spectre and other vulnerabilities at modest performance costs.In this paper, we introduce speculative interference attacks, which show that prior invisible speculation mechanisms do not fully block speculation-based attacks that use cache state. We make two key observations. First, mis-speculated younger instructions can change the timing of older, bound-to-retire instructions, including memory operations. Second, changing the timing of a memory operation can change the order of that memory operation relative to other memory operations, resulting in persistent changes to the cache state. Using both of these observations, we demonstrate (among other attack variants) that secret information accessed by mis-speculated instructions can change the order of bound-to-retire loads. Load timing changes can therefore leave secret-dependent changes in the cache, even in the presence of invisible speculation mechanisms.We show that this problem is not easy to fix: Speculative interference converts timing changes to persistent cache-state changes, and timing is typically ignored by many cache-based defenses. We develop a framework to understand the attack and demonstrate concrete proof-of-concept attacks against invisible speculation mechanisms. To address this problem, we provide security definitions sufficient to block speculative interference attacks; describe a simple defense mechanism with a high performance cost; and discuss how future research can improve its performance.

show abstract

CacheQuery: Learning Replacement Policies from Hardware Caches

Cited by 2 publications

References 0 publications

CACHE SNIPER : Accurate timing control of cache evictions

CACHE SNIPER : Accurate timing control of cache evictions

Speculative Interference Attacks: Breaking Invisible Speculation Schemes

Contact Info

Product

Resources

About