Speculative Buffer Overflows: Attacks and Defenses

Speculative Buffer Overflows: Attacks and DefensesVladimir Attacks that exploit Speculative execution can leakconfidential information via microarchitectural side chan-nels. The recently-demonstrated Spectre Attacks leveragespeculative loads which circumvent access checks to readmemory-resident secrets, transmitting them to an attackerusing cache timing or other covert communication , a new Spectre-v1 variant thatleverages speculativestoresto createspeculative Buffer over-flows. Much like classic Buffer overflows, Speculative out-of-bounds stores can modify data and code pointers. Data-valueattacks can bypass some Spectre-v1 mitigations, either di-rectly or by redirecting control flow. Control-flow attacksenable arbitrary Speculative code execution, which can by-pass fence instructions and all other software mitigationsfor previous Speculative -execution Attacks .

1.1 Spectre1.1: Bounds Check Bypass on Stores Code vulnerable to Spectre1.1 is shown in Listing 2. During speculative execution, the processor may ignore the bounds

Loading..

Information

Related search queries