English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Speculative execution which is used pervasively in modern CPUs can leave sideeffects in the processor caches and other structures even when the speculatedinstructions do not commit and their direct effect is not visible. The recentMeltdown and Spectre attacks have shown that this behavior can be exploited toexpose privileged information to an unprivileged attacker. In particular, theattack forces the speculative execution of a code gadget that will carry outthe illegal read, which eventually gets squashed, but which leaves aside-channel trail that can be used by the attacker to infer the value. Severalattack variations are possible, allowing arbitrary exposure of the full kernelmemory to an unprivileged attacker. In this paper, we introduce a new model(SafeSpec) for supporting speculation in a way that is immune to side-channelleakage necessary for attacks such as Meltdown and Spectre. In particular,SafeSpec stores side effects of speculation in a way that is not visible to theattacker while the instructions are speculative. The speculative state is theneither committed to the main CPU structures if the branch commits, or squashedif it does not, making all direct side effects of speculative code invisible.The solution must also address the possibility of a covert channel fromspeculative instructions to committed instructions before these instructionsare committed. We show that SafeSpec prevents all three variants of Spectre andMeltdown, as well as new variants that we introduce. We also develop a cycleaccurate model of modified design of an x86-64 processor and show that theperformance impact is negligible. We build prototypes of the hardware supportin a hardware description language to show that the additional overhead issmall. We believe that SafeSpec completely closes this class of attacks, andthat it is practical to implement.

SafeSpec: Banishing the Spectre of a Meltdown with Leakage-Free Speculation