Take A Way: Exploring the Security Implications of AMD's Cache Way Predictors

Abstract

To optimize the energy consumption and performance of their CPUs, AMD introduced a way predictor for the L1-data (L1D) cache to predict in which cache way a certain address is located. Consequently, only this way is accessed, significantly reducing the power consumption of the processor. In this paper, we are the first to exploit the cache way predictor. We reverse-engineered AMD's L1D cache way predictor in microarchitectures from 2011 to 2019, resulting in two new attack techniques. With Collide+Probe, an attacker can monitor a victim's memory accesses without knowledge of physical addresses or shared memory when time-sharing a logical core. With Load+ Reload, we exploit the way predictor to obtain highly-accurate memory-access traces of victims on the same physical core. While Load+Reload relies on shared memory, it does not invalidate the cache line, allowing stealthier attacks that do not induce any lastlevel-cache evictions. We evaluate our new side channel in different attack scenarios. We demonstrate a covert channel with up to 588.9 kB/s, which we also use in a Spectre attack to exfiltrate secret data from the kernel. Furthermore, we present a key-recovery attack from a vulnerable cryptographic implementation. We also show an entropy-reducing attack on ASLR of the kernel of a fully patched Linux system, the hypervisor, and our own address space from JavaScript. Finally, we propose countermeasures in software and hardware mitigating the presented attacks. CCS CONCEPTS • Security and privacy → Side-channel analysis and countermeasures; Operating systems security.

Dynamic Process Isolation

“…Göktas et al [31] introduced the concept of a speculative probing primitive that leverages Spectre to break classical and fine-grained address space layout randomization. Gras et al [34], Schwarz et al [86], and Lipp et al [63] also demonstrated that microarchitectural attacks in JavaScript can break memory randomization. Hence, memory randomization is only a small obstacle that can be deterministically circumvented using engineering.…”

Multibyte Microarchitectural Data Sampling and its Application to Session Key Extraction Attacks

“…In simultaneous multi-threaded (SMT) processors, various hardware resources are shared between two logical threads, thus other timing channels may be potentially created. Actually, recent work presented microarchitectural attacks exploiting timing channels existing on an execution port [38], translation look-aside buffer [39], [40], memory order buffer [41], [42] and way predictors [43].…”

A Survey of Microarchitectural Side-channel Vulnerabilities, Attacks and Defenses in Cryptography

“…We mainly focus on the x86 ISA (e.g., Intel and AMD) due to its wide adoption in modern PCs and servers, although some techniques can also be extended to the ARM processors [87,128]. Some works may need the processor to have additional hardware features such as Intel SGX [28,51,85,92,126,138,139,176,180,198,207,222], Intel TSX [61,108] and AMD's cache-way predictor [129]. We will mention the requirements when discussing these works.…”

“…Aciicmez et al [6] designed a side-channel attack against the RSA implementation in OpenSSL by distinguishing the multiplications from square operations. Flush-Reload [15,90,91,199,225] Flush-Flush [89], Reload+Refresh [33] Collide-Probe, Load-Reload [129] LRU state leaking [221] Requires KSM [129] Row buffer contention [158] Rambleed [123] Table 1. Side-channel attack vectors in hardware.…”

“…Cache line states with the replacement policy can also leak side-channel information. Lipp et al [129] exploited the cache way predictor in the AMD processor to identify the victim's memory accesses with two new techniques: Collide-Probe and Load-Reload. Briongos et al [33] reverse engineered the cache replacement policies of the Intel processors and then proposed the Reload+Refresh technique to monitor memory accesses in a cache set without evicting the victim's data.…”