Abstract
In this paper, we provide a systematic analysis of the root cause of the prefetching effect observed in previous works and show that its attribution to a prefetching mechanism is incorrect in all previous works, leading to incorrect conclusions and incomplete defenses.
We show that the root cause is speculative dereferencing of user-space registers in the kernel.
This new insight enables the first end-to-end Foreshadow (L1TF) exploit targeting non-L1 data, despite Foreshadow mitigations enabled, a novel technique to directly leak register values, and several side-channel attacks.
While the L1TF effect is mitigated on the most recent Intel CPUs, all other attacks we present still work on all Intel CPUs and on CPUs by other vendors previously believed to be unaffected.
We show that the root cause is speculative dereferencing of user-space registers in the kernel.
This new insight enables the first end-to-end Foreshadow (L1TF) exploit targeting non-L1 data, despite Foreshadow mitigations enabled, a novel technique to directly leak register values, and several side-channel attacks.
While the L1TF effect is mitigated on the most recent Intel CPUs, all other attacks we present still work on all Intel CPUs and on CPUs by other vendors previously believed to be unaffected.
| Original language | English |
|---|---|
| Publication status | Published - 2021 |
| Event | 25th International Conference on Financial Cryptography and Data Security: FC 2021 - Virtual conference, Virtual Duration: 1 Mar 2021 → 5 Mar 2021 https://fc21.ifca.ai/ |
Conference
| Conference | 25th International Conference on Financial Cryptography and Data Security |
|---|---|
| City | Virtual |
| Period | 1/03/21 → 5/03/21 |
| Internet address |