Hardware Security: Advanced Topics and Trends
Which correctly describes the characteristics of the vulnerability called MDS (Microarchitectural Data Sampling), published in 2019?
- AThe branch predictor is deliberately mistrained so that the victim program speculatively reads array elements outside the bounds, from which secrets are extracted
- BThe same DRAM row is activated many times in a short period, draining charge from cells in the neighbouring rows and flipping bits in data of other processes or the kernel
- CData of other processing held temporarily in buffers inside the CPU, such as line fill buffers, are passed to instructions that execute only transiently
Show answer and explanation
Answer: C. Data of other processing held temporarily in buffers inside the CPU, such as line fill buffers, are passed to instructions that execute only transiently
MDS is a family of transient execution attacks published under names such as RIDL, Fallout and ZombieLoad. On affected CPUs, when a load was cancelled by an exception or similar, data of another process or the kernel left not in the cache but in internal buffers could be passed to subsequent instructions executed transiently, and could be extracted through a cache side channel. The attacker cannot choose the address read but can collect secrets by observing repeatedly. As a countermeasure, microcode updates added a function that clears the internal buffers when switching privilege levels, but another thread using the same core simultaneously through SMT can observe without any switch, so not sharing cores with untrusted parties also became necessary.
- A. This describes Spectre (the bounds-check bypass variant).
- B. This describes Rowhammer.
- C. Correct. Its distinctive feature is that data in internal buffers, not in the cache, leak.
Continue: 9 more Hardware Security: Advanced Topics and Trends questions