Transient-Execution Attacks: A Computer Architect Perspective

Computer architects employ a series of performance optimizations at the micro-architecture level. These optimizations are meant to be invisible to the programmer but they are implicitly programmed alongside the architectural state. Critically, the incorrect results of these optimizations are not scrubbed off the micro-architectural state. This side-effect may seem innocuous. However, through transient-execution, an attacker can leverage this knowledge to obtain information from the micro-architectural state and transmit the data to itself. Transient-Execution is a class of attacks that use the side-effects of executed instructions to leak data. Transient-Execution attacks are split into two categories: speculation-based (Spectre-type) and exception-based (Meltdown-type). A successful attack requires, first, access to the sensitive information, and, second, a transmission channel such that the data can be recovered. Therefore, this survey explains how an attacker can use the state from optimizations in the micro-architecture to access sensitive information from other programs running in the same device; and, once the information is obtained, it describes how the data can be encoded and transmitted in the micro-architectural state. Moreover, it introduces a taxonomy and analyzes defenses for such malicious attacks.