Hardware Security
What is the principle behind the speculative execution vulnerability known as Spectre?
- AA CPU arithmetic error changes the results of additions
- BInstructions executed speculatively along a predicted branch are rolled back, but their traces in the cache remain and can be read by timing measurements
- CSpeculative execution overheats the CPU
Show answer and explanation
Answer: B. Instructions executed speculatively along a predicted branch are rolled back, but their traces in the cache remain and can be read by timing measurements
CPUs execute instructions on the predicted side of a branch before its outcome is known and discard the results if the prediction was wrong. In Spectre, an attacker trains the predictor to mispredict, so a path that should never execute reads secret data and loads a cache location that depends on its value. The results are discarded but the cache state is not restored, so the value can be inferred through a cache side channel.
- A. Computational results are correctly rolled back.
- B. Correct. A performance feature leaves traces.
- C. It is not a temperature problem.