Hall of FamePaul Kocher et al.201867 min readpaperadvanced
Spectre Attacks: Exploiting Speculative Execution
Summary
Spectre shows how mis‑training branch predictors lets an attacker force a CPU to execute transient instructions that leak data via cache side‑channels. The paper defines two practical variants, demonstrates attacks in native code, JavaScript and eBPF, and argues that only hardware redesigns can fully mitigate the threat.
- Mistraining a conditional branch predictor enables out‑of‑bounds reads that survive as cache state, leaking secret bytes (Variant 1).
- Mistraining the Branch Target Buffer to redirect indirect branches to attacker‑chosen gadgets allows arbitrary memory reads (Variant 2).
- The authors built working exploits in native C, JavaScript, and eBPF, proving cross‑process and sandbox breaches on Intel, AMD, and ARM CPUs.
- Software mitigations (e.g., LFENCE, retpoline) are incomplete; robust fixes require changes to CPU microarchitecture and ISA semantics.
CPU architects, OS and runtime developers, and security engineers must understand Spectre to design effective mitigations and avoid false security assumptions.
9/10
