What is Spectre?
A class of vulnerabilities, disclosed in 2018, that induces mispredicted speculative execution to read secret data and infers its value from traces left in the cache.
Field: Hardware Security
Spectre in the explanations
In Spectre, an attacker trains the predictor to mispredict, so a path that should never execute reads secret data and loads a cache location that depends on its value.
What is the principle behind the speculative execution vuln…Countermeasures to Spectre include inserting instructions that halt speculation after conditional branches (such as x86 lfence), masking indices so out-of-range data cannot be read, coding patterns that prevent abuse of indirect branch prediction (such as retpoline) and CPU microcode updates that control predictors.
Which is NOT used as a countermeasure to speculative-execut…Spectre and Meltdown, disclosed in 2018, exploit the fact that although speculatively executed results are discarded, data they loaded remains in the cache; timing differences (a side channel) then reveal secrets that should be inaccessible.
Which is an example of vulnerabilities revealing attacks th…
Questions that mention Spectre (4)
- What is the principle behind the speculative execution vulnerability known as Spectre?
- Why does information still leak in attacks like Spectre even though speculatively executed instructions are rolled back?
- Which is NOT used as a countermeasure to speculative-execution vulnerabilities such as Spectre?
- Which is an example of vulnerabilities revealing attacks that exploit traces of speculative execution left in the cache to infer data that should not be accessible?
Related terms
Speculative execution Instruction set architecture (ISA) Branch prediction Meltdown Anti-rollback protection Cold boot attack Constant-time implementation Counterfeit chip eFuse Fault injection attack