"How much can commodity hardware help on closing microarchitecture timing channels?"

No ratings

Presented at BSidesCanberra 2018 by

Qian Ge

We investigate how different categories of microarchitectural state on recent ARM and x86 processors can be used for covert timing channels and how effective architecture-provided mechanisms are in closing them. We find that in recent Intel processors there is no effective way for sanitising the state of the branch prediction unit and that, contrary to often held belief, flushing the translation lookaside buffer on Intel processors does nothing to mitigate attacks based on this component. We further show that in both ARM and x86 architectures flushing all the hardware caches is not effective to close cache-based timing channels. The implication of this is that resetting the microarchitecture state is basically impossible with operations provided on the commodity hardware.