SPEECHMINER: A Framework for Investigating and Measuring Speculative Execution Vulnerabilities
SPEECHMINER: A Framework for Investigating and Measuring Speculative Execution Vulnerabilities
复制标题
DOI：
10.14722/ndss.2020.23105
复制
发表时间：
2019-12
期刊：
影响因子：
--
通讯作者：
Yuan Xiao;Yinqian Zhang;R. Teodorescu
中科院分区：
文献类型：
--
作者：
Yuan Xiao;Yinqian Zhang;R. Teodorescu
投机性执行端通道硬件(语音)漏洞启用了臭名昭著的Meltdown、Spectre和L1终端故障(L1TF)攻击。虽然许多研究报告了不同的言语脆弱性变体，但它们仍然没有被很好地理解。这主要是由于缺乏有关微处理器实现细节的信息，这些细节影响了各种微体系结构事件的时间和顺序。此外，到目前为止，还没有一种系统的方法来量化衡量商品处理器上的语音脆弱性。本文介绍了SPEECHMINER，一个自动探测和测量语音漏洞的软件框架。SPEECHMINER经验性地建立了一个新的两阶段故障处理模型与语音漏洞的可利用性和投机性窗口之间的联系。它允许在同一软件框架下测试异常触发指令的全面列表，从而利用隐蔽通道技术和差异测试来了解微体系结构状态变化。我们在9种不同的处理器类型上评估了SPEECHMINER，检查了21个潜在的漏洞变体，确认了各种已知攻击，并确定了几个新的变体。
SPEculative Execution side Channel Hardware (SPEECH) Vulnerabilities have enabled the notorious Meltdown, Spectre, and L1 terminal fault (L1TF) attacks. While a number of studies have reported different variants of SPEECH vulnerabilities, they are still not well understood. This is primarily due to the lack of information about microprocessor implementation details that impact the timing and order of various micro-architectural events. Moreover, to date, there is no systematic approach to quantitatively measure SPEECH vulnerabilities on commodity processors. This paper introduces SPEECHMINER, a software framework for exploring and measuring SPEECH vulnerabilities in an automated manner. SPEECHMINER empirically establishes the link between a novel two-phase fault handling model and the exploitability and speculation windows of SPEECH vulnerabilities. It enables testing of a comprehensive list of exception-triggering instructions under the same software framework, which leverages covert-channel techniques and differential tests to gain visibility into the micro-architectural state changes. We evaluated SPEECHMINER on 9 different processor types, examined 21 potential vulnerability variants, confirmed various known attacks, and identified several new variants.