While Last-Level Cache (LLC) side-channel attacks often target inclusive caches, directory-based attacks on noninclusive caches have been demonstrated on Intel and ARM processors. However, the vulnerability of AMD’s non-inclusive caches to such attacks has remained uncertain, primarily due to challenges in reverse-engineering cache addressing, constructing eviction sets, and evicting private cache lines. This paper addresses these challenges and demonstrates the feasibility of conducting LLC side-channel attacks on AMD’s non-inclusive caches. We first reverse-engineer the cache addressing functions for the L2 set index, L3 slice, and L3 set index. Leveraging this insight, we construct the first eviction sets on AMD processors. We then introduce the first LLC sidechannel attack on AMD’s Zen series CPUs. The effectiveness of our approach is validated by attacking OpenSSL’s AES T-table.

With the emergence and proliferation of microarchitectural attacks targeting branch predictors, the once-established security boundary in computer systems and architectures is facing unprecedented challenges. This article introduces an innovative branch predictor modeling methodology that abstractly characterizes 19 states and 53 operations of branch predictors, aiming to assist hardware designers in addressing overlooked security concerns during the microarchitecture design phase. Building upon this modeling discipline, we develop a symbolic execution-based framework to analyze and derive potential vulnerabilities in branch predictors. This framework finally yields 156 valid three-step attack patterns against branch predictors, including 89 novel variants not discovered in previous work. Subsequently, we extend the framework to automatically generate a benchmark suite for assessing the practical feasibility of derived attacks in real-world scenarios. Evaluation across five commercial Intel processors underscores the substantial threat posed by branch predictor attacks, with 130 of the 156 derived attacks proving viable on at least one processor. Finally, we theoretically model and evaluate 12 secure designs related to branch predictors. The evaluation results demonstrate that existing secure branch predictors can offer better security guarantees than secure speculation schemes, indicating that secure branch predictor designs are promising solutions to maintain the confidentiality and integrity of computer systems.

In modern processors, the Retire Control Unit (RCU) is responsible for receiving the µops decoded from the frontend and retiring the completed µops in order through the retirement. Consequently, the retirement may stall differently depending on the execution time of the first instruction in the RCU, causing varying stalling in the RCU reception. Moreover, We find that the RCU reception in AMD processors and retirement in Intel processors are shared between two logical cores of the same physical core, allowing an attacker to infer the instructions executed by another logical core based on its retire resources efficiency. Based on these findings, we introduce the retirement covert channel on Intel processors and the RCU covert channel on AMD processors. Furthermore, we explores additional applications of retire resources. On the one hand, we combined the misprediction penalty mechanism to apply our covert channels to the Spectre attacks. On the other hand, based on the principle that different programs result in varied usage patterns of retire resources, we propose an attack method that leverages the retire resources to infer the program run by the victim. Finally, we design the corresponding mitigations and extend our mitigation to fetch unit to reduce the performance overhead.

In the modern CPU architecture, enhancements such as the Line Fill Buffer (LFB) and Super Queue (SQ), which are designed to track pending cache requests, have significantly boosted performance. To exploit this structure, we deliberately engineered blockages in the L2 to L1d route by controlling LFB conflict and triggering prefetch prediction failures, while consciously dismissing other plausible influencing factors. This approach was subsequently extended to the L3 to L2 and L2 to Lli pathways, resulting in three potent covert channels, termed L2CC, L3CC, and LiCC, with capacities of 10.02 Mbps, 10.37 Mbps, and 1.83 Mbps, respectively. Strikingly, the capacities of L2CC and L3CC surpass those of earlier non-shared-memory-based covert channels, reaching a level comparable to their shared memory-dependent equivalents. Leveraging this congestion further facilitated the extraction of key bits from RSA and EdDSA designs. Coupled with Spectre V1 and V2, our covert channels effectively evade the majority of traditional Spectre defenses. Their confluence with Branch Prediction (BP) Timing assaults additionally undercuts balanced branch protections, hence broadening their capability to infiltrate a wide range of cryptography libraries.

With the intensification of microarchitectural side-channel attacks targeting branch predictors, the security boundary of computer systems and users' security-critical data are under serious threat. Since the root cause of these attacks is the neglect of security issues in the microarchitecture design of branch predictors, an analysis framework that can exhaustively and automatically explore these concerns in the design phase is imminent. In this paper, we propose a comprehensive and automated evaluation framework for inspecting the security guarantees of branch predictors at the microarchitecture design stage. Our technique involves a three-step modeling approach that abstractly characterizes 19 branch predictor states and 53 operations that could affect these states. Subsequently, we develop a symbolic execution-based framework to investigate all three-step combinations and derive 156 valid attack patterns against branch predictors, including 89 novel attacks never considered in the previous work. Finally, we apply our framework to 8 secure branch predictor designs and four typical hardware-based countermeasures against speculative execution attacks to evaluate their security capabilities. The result demonstrates that these security branch predictors provide efficient security guarantees and outperform those hardware-based alleviations against speculative execution attacks, indicating that the security branch predictors are promising in mitigating branch predictor security vulnerabilities.

The backend of the processor executes the μops decoded from the frontend out of order, while the retirement is responsible for retiring completed μops in the Reorder Buffer in order. Consequently, the retirement may stall differently depending on the execution time of the first instruction in the Reorder Buffer. Moreover, since retirement is shared between two logical cores on the same physical core, an attacker can deduce the instructions executed on the other logical core by observing the availability of its own retirement. Based on this finding, we introduce two novel covert channels: the Different Instructions covert channel and the Same Instructions covert channel, which can transmit information across logical cores and possess the ability to bypass the existing protection strategies. Furthermore, this paper explores additional applications of retirement. On the one hand, we propose a new variant of Spectre v1 by applying the retirement to the Spectre attack using the principle that the fallback penalty of misprediction is related to the instructions speculated to be executed. On the other hand, based on the principle that different programs result in varied usage patterns of retirement, we propose an attack method that leverages the retirement to infer the program run by the victim. Finally, we discuss possible mitigations against new covert channels.

As the Internet of Things (IoT) continues to evolve, smartphones have become essential components of IoT systems. However, with the increasing amount of personal information stored on smartphones, user privacy is at risk of being compromised by malicious attackers. Although malware detection engines are commonly installed on smartphones against these attacks, attacks that can evade these defenses may still emerge. In this article, we analyze the return values of system calls on Android smartphones and find two never-disclosed vulnerable return values that can leak fine-grained user behaviors. Based on this observation, we present EavesDroid, an application-embedded side-channel attack on Android smartphones that allows unprivileged attackers to accurately identify fine-grained user behaviors (e.g., viewing messages and playing videos) via on-screen operations. Our attack relies on the correlation between user behaviors and the return values associated with hardware and system resources. While this attack is challenging since these return values are susceptible to fluctuation and misalignment caused by many factors, we show that attackers can eavesdrop on fine-grained user behaviors using a CNN-GRU classification model that adopts min–max normalization and multiple return value fusion. Our experiments on different models and versions of Android smartphones demonstrate that EavesDroid can achieve 98% and 86% inference accuracy for 17 classes of user behaviors in the test set and real-world settings, highlighting the risk of our attack on user privacy. Finally, we recommend effective malware detection, carefully designed obfuscation methods, or restrictions on reading vulnerable return values to mitigate this attack.