TL;DR
CacheOut is a novel microarchitectural attack that bypasses Intel's countermeasures by exploiting cache eviction and transfer to leaky buffers, enabling targeted data leakage across multiple security boundaries.
Contribution
It introduces CacheOut, a new attack method that selectively leaks data from Intel CPU caches despite existing buffer overwrite defenses.
Findings
Can leak data across process and VM boundaries
Allows attacker to choose specific cache lines to leak
Effective against Intel's microcode countermeasures
Abstract
Recent transient-execution attacks, such as RIDL, Fallout, and ZombieLoad, demonstrated that attackers can leak information while it transits through microarchitectural buffers. Named Microarchitectural Data Sampling (MDS) by Intel, these attacks are likened to "drinking from the firehose", as the attacker has little control over what data is observed and from what origin. Unable to prevent the buffers from leaking, Intel issued countermeasures via microcode updates that overwrite the buffers when the CPU changes security domains. In this work we present CacheOut, a new microarchitectural attack that is capable of bypassing Intel's buffer overwrite countermeasures. We observe that as data is being evicted from the CPU's L1 cache, it is often transferred back to the leaky CPU buffers where it can be recovered by the attacker. CacheOut improves over previous MDS attacks by allowing the…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
