Hardware Security

Why does information still leak in attacks like Spectre even though speculatively executed instructions are rolled back?

  1. AThe rollback fails and secret values remain in registers
  2. BSpeculative results are saved to disk
  3. COnly architectural state such as registers is rolled back; microarchitectural state such as caches is not restored
Show answer and explanation

Answer: C. Only architectural state such as registers is rolled back; microarchitectural state such as caches is not restored

CPUs are designed to fully restore program-visible state (registers and memory contents) on a misprediction. But microarchitectural state, such as cache contents and branch predictor state, is internal performance state and is not restored. The ISA contract is honored, yet internal state becomes visible from outside as timing differences; that is the essence of this class of vulnerability.

  • A. Registers are correctly restored.
  • B. Nothing is saved to disk.
  • C. Correct. Only state visible through the ISA is restored.
Practice this topic Back to topic

More Hardware Security questions

  1. What is the principle of the vulnerability called Meltdown, which affected some CPUs?
  2. What is the idea behind KPTI (kernel page-table isolation), introduced as a software countermeasure to Meltdown?
  3. Which is NOT used as a countermeasure to speculative-execution vulnerabilities such as Spectre?
  4. Which statement about countermeasures to speculative-execution vulnerabilities is generally correct?
  5. Among power analysis attacks on chips performing cryptography, what characterizes differential power analysis (DPA)?