What is Transient execution attack?

A general term for attacks that read secrets by exploiting the traces that instructions executed temporarily by the CPU during speculative execution or exception handling, and later discarded, leave in microarchitectural state such as caches. It includes Spectre, Meltdown and MDS, in which data in buffers inside the CPU leak. Countermeasures include microcode updates, OS and compiler mitigations and circuit fixes in newer CPUs, chosen with performance in mind.

Japanese name: 過渡的実行攻撃

Transient execution attack appears in 1 practice question across 1 topic, including Hardware Security: Advanced Topics and Trends.

Field: Hardware Security: Advanced Topics and Trends

Try it: questions about Transient execution attack

Which correctly describes the characteristics of the vulnerability called MDS (Microarchitectural Data Sampling), published in 2019?

  1. AThe branch predictor is deliberately mistrained so that the victim program speculatively reads array elements outside the bounds, from which secrets are extracted
  2. BThe same DRAM row is activated many times in a short period, draining charge from cells in the neighbouring rows and flipping bits in data of other processes or the kernel
  3. CData of other processing held temporarily in buffers inside the CPU, such as line fill buffers, are passed to instructions that execute only transiently
Show answer and explanation

Answer: C. Data of other processing held temporarily in buffers inside the CPU, such as line fill buffers, are passed to instructions that execute only transiently

MDS is a family of transient execution attacks published under names such as RIDL, Fallout and ZombieLoad. On affected CPUs, when a load was cancelled by an exception or similar, data of another process or the kernel left not in the cache but in internal buffers could be passed to subsequent instructions executed transiently, and could be extracted through a cache side channel. The attacker cannot choose the address read but can collect secrets by observing repeatedly. As a countermeasure, microcode updates added a function that clears the internal buffers when switching privilege levels, but another thread using the same core simultaneously through SMT can observe without any switch, so not sharing cores with untrusted parties also became necessary.

Transient execution attack in the explanations

Questions that mention Transient execution attack (1)

  1. Which correctly describes the characteristics of the vulnerability called MDS (Microarchitectural Data Sampling), published in 2019?

Books on Hardware Security: Advanced Topics and Trends Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

SMT (simultaneous multithreading) Arm CCA (Confidential Compute Architecture) CHERI Confidential computing Control-flow integrity DICE (Device Identifier Composition Engine) FIPS 140-3 Hardware bill of materials (HBOM) Laser fault injection Logic locking

Back to the glossary