abstract: 'Modern microarchitectures incorporate optimization techniques such as

  speculative loads and store forwarding to improve the memory bottleneck. The

  processor executes the load speculatively before the stores, and forwards the

  data of a preceding store to the load if there is a potential dependency. This

  enhances performance since the load does not have to wait for preceding stores

  to complete. However, the dependency prediction relies on partial address

  information, which may lead to false dependencies and stall hazards.

  In this work, we are the first to show that the dependency resolution logic

  that serves the speculative load can be exploited to gain information about the

  physical page mappings. Microarchitectural side-channel attacks such as

  Rowhammer and cache attacks rely on the reverse engineering of the

  virtual-to-physical address mapping. We propose the SPOILER attack which

  exploits this leakage to speed up this reverse engineering by a factor of 256.

  Then, we show how this can improve the Prime+Probe attack by a 4096 factor

  speed up of the eviction set search, even from sandboxed environments like

  JavaScript. Finally, we improve the Rowhammer attack by showing how SPOILER

  helps to conduct DRAM row conflicts deterministically with up to 100% chance,

  and by demonstrating a double-sided Rowhammer attack with normal user''s

  privilege. The later is due to the possibility of detecting contiguous memory

  pages using the SPOILER leakage.'
archiveprefix: arXiv
author: Saad Islam and Ahmad Moghimi and Ida Bruhns and Moritz Krebbel and Berk Gulmezoglu
  and Thomas Eisenbarth and Berk Sunar
eprint: 1903.00446v1
file: 1903.00446v1.pdf
files:
- tmpmesn7j2n.pdf
month: Mar
primaryclass: cs.CR
ref: 1903.00446v1
tags: security
title: 'SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks'
type: article
url: http://arxiv.org/abs/1903.00446v1
year: '2019'
