A Practical Introduction to Transient Execution Attacks

Dr. Michael Schwarz

CISPA Helmholtz Center for Information Security, Saarbrücken, Germany

In 2018, a new field of microarchitectural emerged with the publication of Meltdown and Spectre: Transient execution attacks. While traditional microarchitectural side-channel attacks leak metadata, such as memory access patterns, transient execution attacks leak actual data. Transient execution attacks exploit the microarchitectural side effects of instructions that are executed but never retire, i.e., they do not have an architectural effect. Such transient executions are a result of control- and data-flow mispredictions, as well as out-of-order execution after exceptions.

In this tutorial, we start with the basics of measuring cache effects, an essential building block of transient execution attacks. We start with a simple Flush+Reload covert channel used as the encoding part in all further attacks. Using this encoding, we implement a simple Spectre attack and the original Meltdown attack. From that, we gradually adapt the Meltdown attack, resulting in the ZombieLoad attack. Finally, we invert the Meltdown attack to inject data instead of leaking data, demonstrating Load Value Injection.