Exploiting Inaccurate Branch History in Side-Channel Attacks
summary
Paper shows three new primitives — Spectre-BSE, Spectre-BHS and BiasScope — that exploit undocumented BPU behaviors (bias‑free branch prediction, branch status table aliasing, early BHP updates and PHR semantics) to control branch history and force mis‑predictions. Chimera implements an eBPF exploit that leaks kernel memory at 24,628 bit/s. Experiments hit ARM Cortex‑A72 (BST eviction trick) and Cortex‑A76 (high leakage); Intel/AMD impose extra kernel restrictions that limit cross‑privilege hijacks.
AI-written summary · about
chapters (9)
- 0:00Branch history side-channel attacks
- 0:53BPUs handling indirect branches
- 2:15Bias-free branch prediction in Cortex A72
- 4:47Bscope and Spectre BSC attacks
- 6:11Cascaded speculative execution
- 8:17Branch history speculation behavior
- 9:39Exploiting BPU fallback in eBPF
- 11:02Chimera attack with BHP shuffling
- 12:09Conclusion
related talks
01h 03mBPF and Spectre: Mitigating transient execution attacks
51mExploiting Hardware Glitches And Side Channels In Perfect Software
31mInferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing
01h 28m“Spectre: Secrets, Side-Channels, Sandboxes, and Security”
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...
49mBypassing KPTI Using the Speculative Behavior of the SWAPGS Instruction
24mThe Memory of a Meltdown
57mBPF and Security. Friends and Foes