Microarchitecture Security – Cache Side Channel Attacks Lab

Objective

This lab demonstrates how cache side-channel attacks work by measuring memory access times and using the Flush+Reload technique to recover a secret value from another program.

Part 1: Cache vs. Main Memory Timing

Measured the time taken to access data from the CPU cache (L1) and main memory (DRAM). Used measure_one_block_access_time() to measure memory access time. Used clflush() to remove data from the cache and force a slow DRAM access. Observed that: Cache hits are very fast. Cache misses (DRAM) are much slower. A timing threshold can be chosen to determine whether data was in the cache or in main memory.

Part 2: Flush+Reload Attack

A victim program repeatedly accessed a memory location based on a secret flag. The attacker and victim shared the same memory buffer. The attacker: Flushed all candidate memory locations from the cache. Waited briefly for the victim to access its secret location. Reloaded each location and measured the access time. The memory location with the fastest access time revealed the victim’s secret.

Key Observations

Cache timing differences can leak sensitive information. Shared memory allows attackers to observe another program’s cache usage. Predictable memory access based on secret data creates a security vulnerability.

Security Lesson

Cache side-channel attacks show that even when software does not directly reveal a secret, hardware behavior (such as cache timing) can leak information. Secure software should avoid making memory access patterns depend on secret values (constant-time programming) to prevent these attacks.