Skip to content

Session 4 notes

Notes from Session 4: Microarchitecture Security

Flush and reload attack

FLUSH+RELOAD: A High Resolution, Low Noise, L3 Cache Side-Channel Attack - Yuval Yarom and Katrina Falkner, The University of Adelaide

Attacker
    │
    ├── Flush everything
    │
    ├── Wait a little
    │
Victim
    ├── Reads the secret-dependent address
    │
Attacker
    ├── Measure every candidate
    │
    └── One of them is fast

The attack operates in three distinct phases:

  1. Flush: The attacker uses a specific CPU instruction (e.g., clflush) to clear a target memory address from all levels of the processor cache. This forces any subsequent access to retrieve the data from the slower main memory (RAM).
  2. Wait: The attacker pauses briefly, allowing the victim program time to execute and potentially access that specific memory location.
  3. Reload: Attempt to read the same memory address and measures how long the operation takes.

If the victim has accessed the memory address, the CPU will have pulled that data into the shared cache. The attacker’s reload will therefore be incredibly fast (a "cache hit"). If the victim did not access the data, the attacker's read must go to the main memory, taking significantly longer (a "cache miss")

Small emty loop

int i;
for (i = 0; i < 1000; i++);

Looping Constructs

volatile int i;
for (i = 0; i < 1000; i++); 

for (volatile int i = 0; i < 1000; i++) {}


volatile int dummy = 0;
for (int i = 0; i < 1000; i++) {
    dummy++;
}

Flush loop

    for (int i = 0; i < 1024; i++) {
        clflush((ADDR_PTR)(buf + i * ALIGN));
    }

How to use clflush? - stackoverflow

Reload and Mesure loop

for (int i = 0; i < SEC_RANGE; i++) {
    ADDR_PTR addr = (ADDR_PTR)(buf + i * ALIGN);

    uint64_t t1 = __rdtscp(&aux);
    asm volatile("movq (%0), %%rax\n" : : "r"(addr) : "rax");
    uint64_t t2 = __rdtscp(&aux);

    if ((t2 - t1) < CACHE_MISS_THRESHOLD) {
        printf("Secret found: %d\n", i);
    }
}

Types of Memory

Error life

Recompile with -fPIC" error persists even after adding -fPIC compile flag