一句话：提出 AfterImage 侧信道，利用 Intel IP-stride 预取器状态泄露控制流与加载数据，无需推测执行或缓存原语。
处理器侧信道研究通常依赖推测执行和缓存原语来泄露私有数据。本文提出 AfterImage，无需这两者，而是利用 Intel IP-stride 预取器中的漏洞来暴露并传输受害者数据。攻击者用已知值训练预取器，并在执行返回攻击者时观察预取器状态变化，从而监控并泄露大量用户态应用和内核例程中的关键数据。作者展示了跨隔离级的概念验证攻击，端到端地从现代时序均衡算法中泄露完整 RSA 密钥，并证明 AfterImage 可作为高精度标记显著增强功耗侧信道等其他攻击的效果。
Research into processor-based side-channels has seen both a large number and a large variety of disclosed vulnerabilities that can leak critical, private data to malicious attackers. While most previous works require speculative execution and the use of cache primitives to transmit data, our new approach, called AfterImage, requires neither, capitalizing on vulnerabilities in Intel’s IP-stride prefetcher to both expose and transmit victim data. By training this prefetcher with attacker-known values, and watching for changes to the prefetcher state when execution returns to the attacker, it is now possible to monitor and leak critical data from a large number of common userspace applications and kernel routines without speculation and additional cache accesses. To demonstrate the novel capabilities of AfterImage, we (1) present proof-of-concept attacks that leak data across different isolation levels, (2) present an end-to-end attack that leaks an entire RSA key from a modern, timing-balanced algorithm, and also (3) show how AfterImage can significantly improve the effectiveness of other attacks, such as power side-channel attacks, by using this technique as a high-precision marker.
@inproceedings{paperbot10006,
title = {AfterImage: Leaking Control Flow Data and Tracking Load Operations via the Hardware Prefetcher},
author = {Yun Chen and Lingfeng Pei and Trevor E. Carlson},
booktitle = {ASPLOS},
year = {2023},
doi = {10.1145/3575693.3575719}
}