Spectre将继续存在：对边通道和投机执行的分析
Spectre is here to stay: An analysis of side-channels and speculative execution
摘要：
最近发现的Spectre和Meltdown攻击不仅是计算机安全领域的分水岭，也是程序设计语言的分水岭。本文探讨了推测性侧信道攻击及其对程序设计语言的影响。这些攻击通过微架构的侧通道泄漏信息，我们发现这些侧通道不仅仅是错误，实际上是优化的基础。我们确定了三个开放的问题，（1）找到侧通道，（2）理解投机漏洞，（3）减轻它们。对于（1），我们引入了一个数学元模型，该模型阐明了模拟和CPU中的边通道的来源。对于（2），我们引入了一个具有推测语义的体系结构模型来研究最近发现的漏洞。对于（3），我们探索和评估软件缓解措施，并证明一种适用于该模型的缓解措施。我们的分析是通过对V8（Chrome中的生产JavaScript虚拟机）的广泛攻击性研究和防御性实现工作而得出的。对真实硬件模型的直接扩展表明，这些漏洞对有效、高效的缓解提出了巨大的挑战。由于我们的工作，我们现在认为，今天的硬件上的投机漏洞击败了所有语言强制的机密性，没有已知的全面软件缓解措施，因为我们已经发现，不受信任的代码可以构建一个通用的读取小工具，通过侧通道读取同一地址空间中的所有内存。面对这一现实，我们已经将Chrome Web浏览器和V8的安全模型转变为进程隔离。
英文摘要：
The recent discovery of the Spectre and Meltdown attacks represents a watershed moment not just for the field of Computer Security, but also of Programming Languages. This paper explores speculative side-channel attacks and their implications for programming languages. These attacks leak information through micro-architectural side-channels which we show are not mere bugs, but in fact lie at the foundation of optimization. We identify three open problems, (1) finding side-channels, (2) understanding speculative vulnerabilities, and (3) mitigating them. For (1) we introduce a mathematical meta-model that clarifies the source of side-channels in simulations and CPUs. For (2) we introduce an architectural model with speculative semantics to study recently-discovered vulnerabilities. For (3) we explore and evaluate software mitigations and prove one correct for this model. Our analysis is informed by extensive offensive research and defensive implementation work for V8, the production JavaScript virtual machine in Chrome. Straightforward extensions to model real hardware suggest these vulnerabilities present formidable challenges for effective, efficient mitigation. As a result of our work, we now believe that speculative vulnerabilities on today's hardware defeat all language-enforced confidentiality with no known comprehensive software mitigations, as we have discovered that untrusted code can construct a universal read gadget to read all memory in the same address space through side-channels. In the face of this reality, we have shifted the security model of the Chrome web browser and V8 to process isolation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
