一句话：提出读写条件分支预测器 PHR/PHT 的原语，实现控制流恢复与高分辨率瞬态密钥提取。
本文提出针对高性能 CPU 条件分支预测器的新型攻击原语，可读取和操纵路径历史寄存器（PHR）与预测历史表（PHT）。读原语使攻击者能恢复受害者程序完整的控制流历史，作者据此实现了对 libjpeg 例程的控制流捕获并完成秘密图像恢复。写原语支持极高分辨率的瞬态攻击，作者通过对 AES 中间值提取实现密钥恢复。该工作表明条件分支预测器状态可被双向利用，带来控制流泄露与瞬态执行攻击两类新威胁。
This paper introduces novel attack primitives that enable adversaries to leak (read) and manipulate (write) the path history register (PHR) and the prediction history tables (PHTs) of the conditional branch predictor in high-performance CPUs. These primitives enable two new classes of attacks: first, it can recover the entire control flow history of a victim program by exploiting read primitives, as demonstrated by a practical secret-image recovery based on capturing the entire control flow of libjpeg routines. Second, it can launch extremely high-resolution transient attacks by exploiting write primitives. We demonstrate this with a key recovery attack against AES based on extracting intermediate values.
@inproceedings{YavarzadehACGGK24,
title = {Pathfinder: High-Resolution Control-Flow Attacks Exploiting the Conditional Branch Predictor},
author = {Hosein Yavarzadeh and Archit Agarwal and Max Christman and Christina Garman and Daniel Genkin and Andrew Kwong and Daniel Moghimi and Deian Stefan and Kazem Taram and Dean Tullsen},
booktitle = {ASPLOS},
year = {2024},
doi = {10.1145/3620666.3651382}
}