SafeSpec: Banishing the Spectre of a Meltdown with Leakage-Free Speculation

Understand

Speculative execution which is used pervasively in modern CPUs can leave side effects in the processor caches and other structures even when the speculated instructions do not commit and their direct effect is not visible.

• The recent Meltdown and Spectre attacks have shown that this behavior can be exploited to expose privileged information to an unprivileged attacker.
• In particular, the attack forces the speculative execution of a code gadget that will carry out the illegal read, which eventually gets squashed, but which leaves a side-channel trail that can be used by the attacker to infer the value.
• Several attack variations are possible, allowing arbitrary exposure of the full kernel memory to an unprivileged attacker.