Abstract

In recent years, side-channel or micro-architectural vulnerabilities have been getting more spotlighting as Meltdown and Spectre demonstrated their severity in practice.

In order for profit through the vulnerabilities, it is necessary for attackers to utilize a powerful exploitation technique such as cache attack, which has been well-studied by not only academia but also in-the-wild hackers. Unfortunately, the studies tend to be focusing on a specific CPU architecture, Intel, even though other architectures such as ARM, AMD are as important as Intel in terms of security.

We therefore need to understand how different cache attacks are depending on each CPU. By doing so we can understand much better about the vulnerabilities and CPU itself, consequently it is able to exploit them regardless of CPU.

In this talk, I will explore how CPU design differentiates the way of cache attacks by walking through typical cache attack scenarios with relative academic papers including my research. In particular, I will focus on explaining which features in ARM make attacks difficult— and in contrast— which features in Intel make attacks easier.

More technically speaking, we will look at the following topics and how those affect cache attacks— 1) flush or evict cache, 2) cache inclusiveness, 3) SMT (Simultaneous multithreading), 4) cache replacement policy, 5) miscellaneous things—.