You Shall Not Bypass: Employing data dependencies to prevent Bounds Check Bypass

Oleksenko, Oleksii; Trach, Bohdan; Reiher, Tobias; Silberstein, Mark; Fetzer, Christof

doi:10.48550/arxiv.1805.08506

Cited by 8 publications

(16 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…10: Speculative control-flow bending attack example. [9], [32] IRBS, IBPB, STIBP [6], [34] (SLH) [19], (YSNB) [51] Retpoline [65] RSB Stuffing [33] CSF [63] ConTExT [59] SPECCFI Spectre-PHT Spectre-BTB Spectre-RSB SmotherSpectre…”

Section: Related Workmentioning

confidence: 99%

“…LFENCE [6], [9], [32] IRBS, IBPB, STIBP [6], [34] (SLH) [19], (YSNB) [51] Retpoline [65] RSB Stuffing [33] CSF [63] ConTExT [59] SPECCFI [57], [58], [66], [69] since they rely on speculation within a single instruction and therefore do not rely on manipulating the branch prediction structures.…”

Section: Related Workmentioning

confidence: 99%

“…both directions of the branch) [6], [9], [32]. Although liberal serialization (e.g., at every branch instruction) can mitigate Spectre-PHT attacks, doing so severely hurts performance [32]: serializing all branch instructions will eliminate the performance benefit of the branch predictor (e.g., up to 10x slowdown [51]). Against this drawback, multiple proposals tried to reduce the number of serializing instructions introduced using static analysis to serialize execution around exploitable gadgets only [31], [32], [47], [70].…”

Section: A Spectre-pht Defensesmentioning

confidence: 99%

“…Speculative Load Hardening (SLH) [19] and You Shall Not Bypass (YSNB) [51] tried to reduce the high overhead of using liberal fences. Therefore, they proposed to identify Spectre gadgets, then injecting artificial dependencies between branches and identified gadgets.…”

Section: A Spectre-pht Defensesmentioning

confidence: 99%

“…Furthermore, as demonstrated in return-oriented programming [61], by jumping to the middle of an x86 instruction, attackers can use unintended gadget to launch attacks. For this reason, we envision SPECCFI being combined with existing solutions against v1 attacks [19], [51], [63] to provide comprehensive protection against Spectre attacks.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

SPECCFI: Mitigating Spectre Attacks using CFI Informed Speculation

Koruyeh¹,

Shirazi²,

Khasawneh³

et al. 2019

Preprint

View full text Add to dashboard Cite

Spectre attacks and their many subsequent variants are a new vulnerability class for modern CPUs. The attacks rely on the ability to misguide/hijack speculative execution, generally by exploiting the branch prediction structures, to execute a vulnerable code sequence speculatively. In this paper, we propose to use Control-Flow Integrity (CFI), a security technique used to stop control-flow hijacking attacks, on the committed path to prevent speculative control-flow from being hijacked to launch the most dangerous variants of the Spectre attacks (Spectre-BTB and Spectre-RSB). Specifically, CFI attempts to constrain the target of an indirect branch to a set of legal targets defined by a pre-calculated control-flow graph (CFG). As CFI is being adopted by commodity software (e.g., Windows and Android) and commodity hardware (e.g., Intel's CET and ARM's BTI), the CFI information could be readily available through the hardware CFI extensions. With the CFI information, we apply CFI principles to also constrain illegal control-flow during speculative execution. SPECCFI ensures that control flow instructions target legal destinations to constrain dangerous speculation on forward control-flow paths (indirect calls and branches). We complement our solution with a precise speculation-aware hardware stack to constrain speculation on backward control-flow edges (returns). We combine this solution with existing solutions against branch target predictor attacks (Spectre-PHT) to close all non-vendorspecific Spectre vulnerabilities. We show that SPECCFI results in small overheads both in terms of performance and additional hardware complexity.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: A Spectre-pht Defensesmentioning

confidence: 99%

Section: A Spectre-pht Defensesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

SPECCFI: Mitigating Spectre Attacks using CFI Informed Speculation

Koruyeh¹,

Shirazi²,

Khasawneh³

et al. 2019

Preprint

View full text Add to dashboard Cite

show abstract

Half&Half: Demystifying Intel’s Directional Branch Predictors for Fast, Secure Partitioned Execution

Yavarzadeh,

Taram,

Narayan

et al. 2023

2023 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

This paper presents Half&Half, a novel software defense against branch-based side-channel attacks. Half&Half isolates the effects of different protection domains on the conditional branch predictors (CBPs) in modern Intel processors. This work presents the first exhaustive analysis of modern conditional branch prediction structures, and reveals for the first time an unknown opportunity to physically partition all CBP structures and completely prevent leakage between two domains using the shared predictor. Half&Half is a software-only solution to branch predictor isolation that requires no changes to the hardware or ISA, and only requires minor modifications to be supported in existing compilers. We implement Half&Half in the LLVM and WebAssembly compilers and show that it incurs an order of magnitude lower overhead compared to the current state-of-the-art branch-based sidechannel defenses.

show abstract

oo7: Low-Overhead Defense Against Spectre Attacks via Program Analysis

Wang

Chattopadhyay

Gotovchits

et al. 2021

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

The Spectre vulnerability in modern processors has been widely reported. The key insight in this vulnerability is that speculative execution in processors can be misused to access secrets speculatively. Subsequently even though the speculatively executed instructions are squashed, the secret may linger in micro-architectural states such as cache, and can potentially be accessed by an attacker via side channels. We propose oo7, a static analysis approach that can mitigate Spectre attacks by detecting potentially vulnerable code snippets in program binaries and protecting them against the attack. We employ control flow extraction, taint analysis and address analysis to detect tainted conditional branches and speculative memory accesses. oo7 can detect all fifteen purpose-built Spectre-vulnerable code patterns [1], whereas Microsoft compiler with Spectre mitigation option can only detect two of them. We also report the results of a large-scale study on applying oo7 to over 500 program binaries (average binary size 261 KB) from different real-world projects. We protect programs against Spectre attack by selectively inserting fences only at vulnerable conditional branches to prevent speculative execution. Our approach is experimentally observed to incur around 4% performance overheads on SPECint 2006 benchmarks. Finally, we demonstrate that our approach is flexible and can be tuned to detect many other emerging Spectre variants, as well as Meltdown and Foreshadow attacks.

show abstract

You Shall Not Bypass: Employing data dependencies to prevent Bounds Check Bypass

Cited by 8 publications

References 0 publications

SPECCFI: Mitigating Spectre Attacks using CFI Informed Speculation

SPECCFI: Mitigating Spectre Attacks using CFI Informed Speculation

Half&Half: Demystifying Intel’s Directional Branch Predictors for Fast, Secure Partitioned Execution

oo7: Low-Overhead Defense Against Spectre Attacks via Program Analysis

Contact Info

Product

Resources

About