Prime+Retouch：当缓存被锁定与泄露
Prime+Retouch: When Cache is Locked and Leaked
AI总结：
本文提出 Prime+Retouch 攻击，利用缓存替换策略元数据在无驱逐、极少同步条件下绕过现有缓存侧信道防御，并在 Intel x86 和 Apple M1 上验证其可攻破 AES 及 SGX 环境。
摘要：
现代商用 CPU 上的缓存已成为侧信道泄露的主要来源之一，并被滥用为一种新的攻击向量。为了挫败基于缓存的侧信道攻击，已提出两类对策：一类是基于检测的方案，限制攻击者能够留下的微架构痕迹数量；另一类是缓存预取与锁定技术，声称通过禁止对敏感数据的驱逐来防止此类泄露。在本文中，我们提出了 Prime+Retouch 攻击，它通过利用缓存替换策略的元数据准确推断缓存活动，从而完全绕过这些防御方案。Prime+Retouch 具有三个显著特性：1）它不会对受害者的数据造成任何驱逐，使我们能够绕过两种已知的缓解方案；2）它只需要极少的同步，即仅对攻击者预先填充的缓存行进行一次内存访问；3）它通过非共享内存泄露数据，但这是因为底层的驱逐元数据是共享的。我们在两种架构上演示了 Prime+Retouch：主流的 Intel x86 和新兴的 Apple M1。我们阐明了 Prime+Retouch 如何在普通环境和 SGX 保护环境下，攻破具有稳健缓存侧信道缓解措施（如 Cloak）的 AES T 表实现。我们还展示了 Prime+Retouch 攻击在 M1 平台上的可行性，该平台施加了更多限制，攻击者无法访问核心时钟周期计时器和性能计数器等精确测量工具。此外，我们首次揭开了 Apple M1 架构上未公开的缓存架构及其 L1 数据缓存驱逐策略的面纱。我们还通过重新利用 Intel TSX，设计了一个用户空间无噪声缓存监控工具。
英文摘要：
Caches on the modern commodity CPUs have become one of the major sources of side-channel leakages and been abused as a new attack vector. To thwart the cache-based side-channel attacks, two types of countermeasures have been proposed: detection-based ones that limit the amount of microarchitectural traces an attacker can leave, and cache prefetching-and-locking techniques that claim to prevent such leakage by disallowing evictions on sensitive data. In this paper, we present the Prime+Retouch attack that completely bypasses these defense schemes by accurately inferring the cache activities with the metadata of the cache replacement policy. Prime+Retouch has three noticeable properties: 1) it incurs no eviction on the victim's data, allowing us to bypass the two known mitigation schemes, 2) it requires minimal synchronization of only one memory access to the attacker's pre-primed cache lines, and 3) it leaks data via non-shared memory, yet because underlying eviction metadata is shared. We demonstrate Prime+Retouch in two architectures: predominant Intel x86 and emerging Apple M1. We elucidate how Prime+Retouch can break the T-table implementation of AES with robust cache side-channel mitigations such as Cloak, under both normal and SGX-protected environments. We also manifest feasibility of the Prime+Retouch attack on the M1 platform imposing more restrictions where the precise measurement tools such as core clock cycle timer and performance counters are inaccessible to the attacker. Furthermore, we first demystify undisclosed cache architecture and its eviction policy of L1 data cache on Apple M1 architecture. We also devise a user-space noise-free cache monitoring tool by repurposing Intel TSX.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
