Microarchitectural Attacks and Security

4.

Specialized Microarchitectural Attacks

4.1.

DRAM-Based Attacks

4.1.1.

Rowhammer Fundamentals

4.1.1.1.

DRAM Cell Structure and Operation

4.1.1.2.

Charge Leakage and Disturbance

4.1.1.3.

Row Activation Patterns

4.1.2.

Rowhammer Attack Techniques

4.1.2.1.

Double-Sided Rowhammer

4.1.2.2.

Single-Sided Rowhammer

4.1.2.3.

One-Location Hammering

4.1.3.

Rowhammer Exploitation

4.1.3.1.

Bit Flip Detection

4.1.3.2.

Privilege Escalation Techniques

4.1.3.3.

Page Table Manipulation

4.1.3.4.

Cryptographic Key Corruption

4.1.4.

Advanced DRAM Attacks

4.1.4.1.

TRRespass (Many-Sided Rowhammer)

4.1.4.2.

RAMBleed (Data Reading via Rowhammer)

4.2.

Port Contention Attacks

4.2.1.

Execution Port Architecture

4.2.2.

SMT Resource Sharing Exploitation

4.2.3.

Port Contention Measurement

4.2.4.

Data Inference from Contention Patterns

4.3.

Translation Lookaside Buffer Attacks

4.3.1.

TLBleed Attack Mechanism

4.3.2.

TLB State Observation

4.3.3.

Address Translation Leakage

4.3.4.

Cross-Process TLB Attacks

4.4.

Secure Enclave Attacks

4.4.1.

Intel SGX Attack Surface

4.4.2.

SGAxe Cache-Based Attacks

4.4.3.

Enclave Memory Layout Inference

4.4.4.

Attestation and Sealing Attacks

4.5.

Network-Based Microarchitectural Attacks

4.5.1.

NetSpectre Remote Timing

4.5.2.

Network Timing Side Channels

4.5.3.

Remote Cache Attacks

4.5.4.

Amplification Techniques

Previous

3. Transient Execution Attacks

Go to top

Next

5. Attack Methodology and Implementation