Microarchitectural Attacks and Security

3.

Transient Execution Attacks

3.1.

Transient Execution Fundamentals

3.1.1.

Speculative Execution Principles

3.1.2.

Transient Instruction Effects

3.1.3.

Microarchitectural State Changes

3.1.4.

Exception Handling in Speculation

3.2.

Spectre Attack Family

3.2.1.

Spectre Variant 1 (Bounds Check Bypass)

3.2.1.1.

Conditional Branch Misprediction

3.2.1.2.

Array Bounds Check Bypass

3.2.1.3.

Speculative Memory Access

3.2.1.4.

Cache-Based Information Extraction

3.2.1.5.

Gadget Identification

3.2.2.

Spectre Variant 2 (Branch Target Injection)

3.2.2.1.

Indirect Branch Prediction

3.2.2.2.

Branch Target Buffer Poisoning

3.2.2.3.

Cross-Process BTB Pollution

3.2.2.4.

Return-Oriented Programming Integration

3.2.3.

Spectre-RSB (Return Stack Buffer)

3.2.3.1.

Return Stack Buffer Operation

3.2.3.2.

RSB Underflow Exploitation

3.2.3.3.

Call-Return Pair Manipulation

3.2.4.

Spectre-BTB (Branch Target Buffer)

3.2.4.1.

BTB Collision Exploitation

3.2.4.2.

Address Aliasing Attacks

3.2.4.3.

Cross-Privilege BTB Sharing

3.2.5.

Spectre Variants in Different Contexts

3.2.5.1.

Browser-Based Spectre

3.2.5.2.

Kernel-Level Spectre

3.2.5.3.

Hypervisor Spectre

3.3.

Meltdown Attack Family

3.3.1.

Meltdown Prime (Rogue Data Cache Load)

3.3.1.1.

Privilege Check Bypass

3.3.1.2.

Kernel Memory Access from User Space

3.3.1.3.

Exception Handling Exploitation

3.3.1.4.

Cache-Based Data Extraction

3.3.2.

Meltdown Variants

3.3.2.1.

Meltdown-BR (Bounds Check Bypass)

3.3.2.2.

Meltdown-PK (Protection Key Bypass)

3.3.2.3.

Meltdown-GP (General Protection Fault)

3.4.

Foreshadow/L1TF Attacks

3.4.1.

L1 Terminal Fault Exploitation

3.4.2.

SGX Enclave Memory Extraction

3.4.3.

Virtual Machine Memory Leakage

3.4.4.

Hypervisor Attack Scenarios

3.5.

Microarchitectural Data Sampling (MDS)

3.5.1.

MDS Attack Principles

3.5.2.

RIDL (Rogue In-Flight Data Load)

3.5.2.1.

Fill Buffer Exploitation

3.5.2.2.

Load Port Data Sampling

3.5.3.

3.5.3.1.

Store Buffer Data Leakage

3.5.4.

3.5.4.1.

Line Fill Buffer Attacks

3.5.4.2.

Cross-Logical-Core Data Sampling

3.5.5.

RIDL and Fallout Variants

3.5.5.1.

TAA (TSX Asynchronous Abort)

3.5.5.2.

Previous

2. Cache-Based Side Channel Attacks

Go to top

Next

4. Specialized Microarchitectural Attacks