Last-Level Cache Side-Channel Attacks are Practical

Gernot Heiser; Fangfei Liu; Yuval Yarom; Qian Ge; Ruby B. Lee

doi:10.1109/sp.2015.43

Last-Level Cache Side-Channel Attacks are Practical

Атаки по побочным каналам на кэш последнего уровня практично осуществимы

Gernot Heiser, Fangfei Liu, Yuval Yarom, Qian Ge, Ruby B. Lee

2015-05-01

SCID: 54.1/87ja62t6 Discuss with AI

GnuPGPrime+Probecross-VM attacklast-level cacheside-channel attack

Abstract (AI)

We present an effective implementation of the Prime+Probe side-channel attack against the last-level cache. We measure the capacity of the covert channel the attack creates and demonstrate a cross-core, cross-VM attack on multiple versions of GnuPG. Our technique achieves a high attack resolution without relying on weaknesses in the OS or virtual machine monitor or on sharing memory between attacker and victim.

Key Findings

A cross-core, cross-virtual-machine attack is demonstrated against multiple GnuPG versions.

The attack creates a measurable covert channel with high resolution.

The attack does not require operating-system or virtual-machine-monitor weaknesses, nor memory sharing between attacker and victim.

The paper presents an effective Prime+Probe implementation targeting the last-level cache.

The results show that last-level cache side-channel attacks are practical in realistic isolation settings.

Research Object

Last-level CPU cache (as exploited by Prime+Probe side-channel attacks)

Research Subject

the practicality, covert-channel capacity, and attack resolution of Prime+Probe side-channel attacks against the last-level cache

Publication Details

DOI

10.1109/sp.2015.43

Publication Date

2015-05-01

Journal

Publisher

ISSN

Open access PDF

https://ieeexplore.ieee.org/ielx7/7160813/71630…

Access Type

Author Information

Authors

Gernot Heiser

Fangfei Liu

Yuval Yarom

Qian Ge

Ruby B. Lee

Download PDF

Make a presentation

References available in scid.ai4

S$A: A Shared Cache Attack That Works across Cores and Defies VM Sandboxing -- and Its Application to AES2015 Cross-Tenant Side-Channel Attacks in PaaS Clouds2014 The Elements of Statistical Learning: Data Mining, Inference, and Prediction2010 A method for obtaining digital signatures and public-key cryptosystems1978

Cited by7

Systematic Analysis of Randomization-based Protected Cache Architectures2021 NetCAT: Practical Cache Attacks from the Network2020 Attack Directories, Not Caches: Side Channel Attacks in a Non-Inclusive World2019 ASLR on the Line: Practical Cache Attacks on the MMU2017 A Software Approach to Defeating Side Channels in Last-Level Caches2016 Cache Template Attacks: Automating Attacks On Inclusive Last-Level Caches2015 S$A: A Shared Cache Attack That Works across Cores and Defies VM Sandboxing -- and Its Application to AES2015