An Attack on The Speculative Vectorization: Leakage from Higher Dimensional Speculation

TL;DR

This paper demonstrates that speculative vectorization can leak sensitive information through microarchitectural side channels, showing vulnerabilities in Apple M2 and proposing descriptive models for such leaks.

Contribution

It reveals the fundamental vulnerability of speculative vectorization to microarchitectural leakage and introduces Microarchitectural Leakage Descriptors for analyzing such leaks.

Findings

Leakage demonstrated on Apple M2 SoC

Microarchitectural Leakage Descriptors (MLD) introduced

Reverse engineering of cache size performed

Abstract

This paper argues and shows that speculative vectorization, where a loop with rare or unknown memory dependencies are still vectorized, is fundamentally vulnerable and cannot be mitigated by existing defenses. We implement a simple proof of concept and show the leakage in Apple M2 SoC. We describe the source of leakage using Microarchitectural Leakage Descriptors MLD and we additionally describe principles to extend MLD for other optimization. Also as part of implementation we reverse engineer the M2 cache size and use threaded timer to differentiate between cache hit and miss.