一句话：提出 BranchScope 攻击，通过操纵共享方向分支预测器推断受害者条件分支方向，并成功攻击 SGX enclave。
此前针对分支预测单元（BPU）的侧信道研究主要集中于分支目标缓冲（BTB），而负责存储分支跳转方向预测的方向分支预测器是否可被细粒度攻击尚不清楚。本文提出 BranchScope：攻击者通过操纵与受害者共享的方向分支预测器状态，推断受害者程序中任意条件分支的跳转方向。由于现代处理器采用结构未知的复杂混合分支预测器，攻击者先迫使其退化为简单的单级（1-level）模式，从而简化方向恢复过程。作者在多种近期 Intel CPU 上实现了 BranchScope，并进一步演示了对 SGX enclave 的成功攻击，表明方向分支预测器构成被低估的侧信道脆弱面。
We present BranchScope - a new side-channel attack where the attacker infers the direction of an arbitrary conditional branch instruction in a victim program by manipulating the shared directional branch predictor. The directional component of the branch predictor stores the prediction on a given branch (taken or not-taken) and is a different component from the branch target buffer (BTB) attacked by previous work. BranchScope is the first fine-grained attack on the directional branch predictor, expanding our understanding of the side channel vulnerability of the branch prediction unit. Our attack targets complex hybrid branch predictors with unknown organization. We demonstrate how an attacker can force these predictors to switch to a simple 1-level mode to simplify the direction recovery. We carry out BranchScope on several recent Intel CPUs and also demonstrate the attack against an SGX enclave.
DOI 原文 ·
@inproceedings{paperbot4275,
title = {BranchScope},
author = {Dmitry Evtyushkin and Ryan Riley and Nael CSE and ECE Abu-Ghazaleh and Dmitry Ponomarev},
booktitle = {ASPLOS},
year = {2018},
doi = {10.1145/3173162.3173204}
}