Uncovering and Exploiting AMD Speculative Memory Access Predictors for Fun and Profit

Liu, Chang1; Wang, Dongsheng1,2; Lyu, Yongqiang1; Qiu, Pengfei3; Jin, Yu3; Lu, Zhuoyuan3; Zhang, Yinqian4; Qu, Gang5

10.1109/HPCA57654.2024.00014

2024

30th IEEE International Symposium on High-Performance Computer Architecture (HPCA)

1530-0897

2024 IEEE INTERNATIONAL SYMPOSIUM ON HIGH-PERFORMANCE COMPUTER ARCHITECTURE, HPCA 2024

MAR 02-06, 2024

null,Edinburgh,SCOTLAND

10662 LOS VAQUEROS CIRCLE, PO BOX 3014, LOS ALAMITOS, CA 90720-1264 USA

IEEE COMPUTER SOC

This paper presents a comprehensive investigation into the security vulnerabilities associated with speculative memory access on AMD processors. Firstly, employing novel reverse engineering techniques, our study uncovers two key predictors, namely the Predictive Store Forwarding Predictor (PSFP) and the Speculative Store Bypass Predictor (SSBP), along with elucidating their internal structures and state machine designs. Secondly, our research empirically confirms that these predictors can be deliberately manipulated and altered during transient execution, resulting in secret leakage across security domains. Leveraging these discoveries, we propose innovative attacks targeting these predictors, including an out-of-place variant of Spectre-STL and an entirely new form of Spectre attack named Spectre-CTL. Finally, we establish experimentally that enabling Speculative Store Bypass Disable alleviates the vulnerabilities. However, this comes at the expense of significant performance degradation.

其他

英语

CPCI-S ; EI

National Key Research and Development Program of China[2021YFB3100902] ; National Natural Science Foundation of China["U23B2041","62072263","62372258"] ; Fundamental Research Funds for the Central Universities[2023RC71]

Computer Science ; Engineering

Computer Science, Hardware & Architecture ; Computer Science, Theory & Methods ; Engineering, Electrical & Electronic

WOS:001207751400003

Web of Science

1.Tsinghua Univ, Beijing, Peoples R China
2.Zhongguancun Lab, Beijing, Peoples R China
3.Beijing Univ Posts & Telecommun, Beijing, Peoples R China
4.Southern Univ Sci & Technol, Shenzhen, Peoples R China
5.Univ Maryland, College Pk, MD 20742 USA

Liu, Chang,Wang, Dongsheng,Lyu, Yongqiang,et al. Uncovering and Exploiting AMD Speculative Memory Access Predictors for Fun and Profit[C]. 10662 LOS VAQUEROS CIRCLE, PO BOX 3014, LOS ALAMITOS, CA 90720-1264 USA:IEEE COMPUTER SOC,2024.