MeltdownPrime和SpectrePrime：利用基于失效的一致性协议的自动合成攻击
MeltdownPrime and SpectrePrime: Automatically-Synthesized Attacks Exploiting Invalidation-Based Coherence Protocols
摘要：
最近的Meltdown和Spectre攻击突出了自动验证技术在识别硬件安全漏洞方面的重要性。我们已经开发出一种工具，用于合成微体系结构特定的程序，能够产生任何用户指定的硬件执行模式的利益。我们的工具需要两个输入：（i）以域特定语言的微体系结构，以及（ii）感兴趣的微体系结构执行模式，例如威胁模式的形式描述。我们的工具合成的所有程序都能够在提供的微架构上产生指定的执行模式。我们使用我们的工具来指定一个常见的硬件执行模式，以Flush+恶意攻击和自动合成的安全石蕊测试，代表那些已经公开披露的用于进行Meltdown和Spectre攻击。我们还制定了一个Prime+Probe威胁模式，使我们的工具能够合成每个的新变体-MeltdownPrime和SpectrePrime。这两个新的漏洞都使用Prime+Probe方法来进行定时攻击。它们都是新颖的，因为它们是利用现代缓存一致性协议中的缓存线失效机制的2核攻击。这是Meltdown和Spectre的第一个提议的Prime+Probe变体。但更重要的是，这两种Prime攻击都利用了基于无效的一致性协议，以达到与Flush+ Punchad攻击相同的精度水平。虽然软件中的缓解技术（例如，防止投机的障碍）对于我们的Prime变体可能与原始Spectre和Meltdown相同，我们相信针对它们的硬件保护将是不同的。作为概念验证，我们将SpectrePrime实现为C程序，并在Intel x86处理器上运行，在100次运行中，平均精度与Spectre相同--Spectre为97.9%，SpectrePrime为99.95%。
英文摘要：
The recent Meltdown and Spectre attacks highlight the importance of automated verification techniques for identifying hardware security vulnerabilities. We have developed a tool for synthesizing microarchitecture-specific programs capable of producing any user-specified hardware execution pattern of interest. Our tool takes two inputs: a formal description of (i) a microarchitecture in a domain-specific language, and (ii) a microarchitectural execution pattern of interest, e.g. a threat pattern. All programs synthesized by our tool are capable of producing the specified execution pattern on the supplied microarchitecture. We used our tool to specify a hardware execution pattern common to Flush+Reload attacks and automatically synthesized security litmus tests representative of those that have been publicly disclosed for conducting Meltdown and Spectre attacks. We also formulated a Prime+Probe threat pattern, enabling our tool to synthesize a new variant of each---MeltdownPrime and SpectrePrime. Both of these new exploits use Prime+Probe approaches to conduct the timing attack. They are both also novel in that they are 2-core attacks which leverage the cache line invalidation mechanism in modern cache coherence protocols. These are the first proposed Prime+Probe variants of Meltdown and Spectre. But more importantly, both Prime attacks exploit invalidation-based coherence protocols to achieve the same level of precision as a Flush+Reload attack. While mitigation techniques in software (e.g., barriers that prevent speculation) will likely be the same for our Prime variants as for original Spectre and Meltdown, we believe that hardware protection against them will be distinct. As a proof of concept, we implemented SpectrePrime as a C program and ran it on an Intel x86 processor, averaging about the same accuracy as Spectre over 100 runs---97.9% for Spectre and 99.95% for SpectrePrime.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
