Prime+Abort: A Timer-Free High-Precision L3 Cache Attack using Intel TSX
summary
A cache attack leverages Intel TSX transactional aborts to detect L3 cache line evictions without any timers, replacing probe timing with a hardware callback. It generates eviction sets on-the-fly (about 5× faster than PRIME+PROBE), reaches a peak detection rate of 1,000,000 events/sec (vs ~300k for PRIME+PROBE) with fewer false positives (~200 vs ~250), works across cores/VMs without shared memory, and recovers keys from OpenSSL t‑table AES demonstrating full AES key recovery.
AI-written summary · about
chapters (12)
- 0:00Introduction to Prime+Abort
- 1:57Processor cache fundamentals
- 3:50Intel TSX explained
- 6:04TSX and side channels
- 8:38Structure of cache attacks
- 10:22Prime+Probe vs Prime+Abort
- 13:13Strengths and limitations
- 15:20Generating eviction sets
- 17:12Experimental results
- 19:25Proof of concept
- 20:15Countermeasures
- 23:34Conclusion and Q&A
related talks
27mTranslation Leak-aside Buffer: Defeating Cache Side-channel Protections
35mShowTime: CPU Timing Attacks With the Human Eye
48mCapturing 0Day Exploits With Perfectly Placed Hardware Traps
29mARMageddon: Cache Attacks on Mobile Devices
35mPage Cache Attacks: Microarchitectural Attacks on Flawless Hardware
15mI Know What You Said: Unveiling Hardware Cache Side-Channels in Local Large
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
39mSecure Cache Designs: State of the Art and ...