论文标题
您不能总是赢得比赛：分析分支目标注入的LFENCE/JMP缓解措施
You Cannot Always Win the Race: Analyzing the LFENCE/JMP Mitigation for Branch Target Injection
论文作者
论文摘要
LFENCE/JMP是分支目标注入（BTI）的现有软件缓解选项，也是由间接分支预测引起的类似的瞬态执行攻击，该预测通常用于AMD处理器。但是，这种缓解措施的有效性可能会因预测目标的投机执行与预期目标的架构解决方案之间的固有种族条件所损害，因为这可以创建一个窗口，在该窗口中，代码仍然可以暂时执行。 这项工作调查了可能导致这种猜测窗口的潜在潜在潜在来源。我们表明攻击者可以“赢得比赛”，因此，尽管存在LFENCE/JMP缓解措施，但该窗口仍然足以允许对各种不同X86 CPU进行BTI风格的攻击。
LFENCE/JMP is an existing software mitigation option for Branch Target Injection (BTI) and similar transient execution attacks stemming from indirect branch predictions, which is commonly used on AMD processors. However, the effectiveness of this mitigation can be compromised by the inherent race condition between the speculative execution of the predicted target and the architectural resolution of the intended target, since this can create a window in which code can still be transiently executed. This work investigates the potential sources of latency that may contribute to such a speculation window. We show that an attacker can "win the race", and thus that this window can still be sufficient to allow exploitation of BTI-style attacks on a variety of different x86 CPUs, despite the presence of the LFENCE/JMP mitigation.
