Flush+Flush: A Fast and Stealthy Cache Attack (1511.04594v3)

Abstract: Research on cache attacks has shown that CPU caches leak significant information. Proposed detection mechanisms assume that all cache attacks cause more cache hits and cache misses than benign applications and use hardware performance counters for detection. In this article, we show that this assumption does not hold by developing a novel attack technique: the Flush+Flush attack. The Flush+Flush attack only relies on the execution time of the flush instruction, which depends on whether data is cached or not. Flush+Flush does not make any memory accesses, contrary to any other cache attack. Thus, it causes no cache misses at all and the number of cache hits is reduced to a minimum due to the constant cache flushes. Therefore, Flush+Flush attacks are stealthy, i.e., the spy process cannot be detected based on cache hits and misses, or state-of-the-art detection mechanisms. The Flush+Flush attack runs in a higher frequency and thus is faster than any existing cache attack. With 496 KB/s in a cross-core covert channel it is 6.7 times faster than any previously published cache covert channel.

• The paper presents a novel attack method, Flush+Flush, that exploits clflush execution timing to avoid memory accesses and remain undetectable.
• It achieves a covert channel speed of 496 KB/s, outperforming previous cache attacks by a factor of 6.7 while producing minimal cache events.
• The study advocates for hardware changes such as constant-time clflush to bolster cache security and counteract advanced cache attacks.

Overview of "Flush+Flush: A Fast and Stealthy Cache Attack"

This paper presents an innovative technique in the field of cache attacks, named the Flush+Flush attack. Developed by researchers Daniel Gruss, Clémentine Maurice, Klaus Wagner, and Stefan Mangard, this method challenges conventional assumptions regarding cache attack detection and performance.

Flush+Flush Attack: Methodology and Novelty

The cornerstone of the Flush+Flush technique lies in its reliance on the execution time of the clflush instruction, which inherently differentiates between cached and non-cached data. Unlike traditional cache attacks, Flush+Flush does not entail any memory accesses, resulting in the absence of cache misses and a minimal count of cache hits. This characteristic renders the attack particularly stealthy and allows it to evade detection mechanisms predicated on monitoring cache hits and misses, a common strategy utilizing hardware performance counters.

In stark contrast to the existing Flush+Reload method, Flush+Flush remains undetectable by contemporary countermeasures. While both methods share reliance on properties inherent to shared memory and cross-core functionality, the new strategy eliminates direct memory access, emphasizing its stealthiness and speed.

Performance and Detection Challenges

Flush+Flush outstrips existing cache attacks in terms of speed. It achieves a cross-core covert channel transmission rate of 496 KB/s, surpassing previously documented methods by a factor of 6.7 in terms of speed. This pronounced performance enhancement is achieved without compromising detection metrics, as illustrated by the ineffectiveness of conventional performance counter-based methods in identifying Flush+Flush activity.

The researchers undertook extensions of their analysis, evaluating the detectability of the attack through gauging hardware performance counters in various operational scenarios. Their findings robustly demonstrate that Flush+Flush subverts traditional detection assumptions, thereby necessitating a reconsideration of cache security paradigms.

Implications and Future Prospects

The introduction of the Flush+Flush technique has concrete implications both for the immediate understanding of cache behavior and the development of future defenses. While the paper suggests making the clflush instruction constant-time to counteract this attack, such measures would require changes in hardware architecture—a non-trivial consideration.

Additionally, the paper highlights that altering the clflush functionality would minimally impact extant software, making it a viable approach for enhancing system security. From a theoretical standpoint, the research propels forward the understanding of cache attack mechanics and broadens the scope for future exploration and refinement of both offensive and defensive strategies.

Conclusion

In conclusion, the Flush+Flush technique represents a significant development in cache attacks, underscoring the need to continuously adapt detection and prevention strategies in the face of evolving methodologies. The attack's combination of speed and stealth challenges existing detection frameworks and necessitates advancing both theoretical research and practical countermeasures within the field.