Understand Spectre/Meltdown Side-Channel Attacks

Speculation Leaks Secrets

Spectre and Meltdown exploit speculative execution and cache timing. The CPU may transiently execute instructions that should never commit; microarchitectural side effects (cached lines) remain measurable.

cCopy
Loading…

Even when x is out of bounds and the branch later rolls back, the probe line may enter cache, revealing secret[x] via timing.

Mitigations

• Meltdown: kernel page table isolation (KPTI), map fewer user-accessible kernel pages
• Spectre v1: bounds check hardening, retpolines on indirect branches
• Spectre v2: IBRS, branch prediction barriers on privilege transitions

For this exercise, you will study a toy flush+reload or speculative load demo in a controlled sandbox. This task asks you to explain why fences alone do not fix speculation, connecting pipeline speculation from earlier tasks to CVE-2017-5753/5754.

Working Through the Exercise

Keep the relevant datasheet, ISA manual, or architecture textbook chapter open while you implement. When your output disagrees with the reference trace on the same program, the bug is usually a mis-decoded opcode, a stale register read, or a flag bit left unchanged after arithmetic.

• Trace first: walk one failing input by hand before changing random lines
• Read the manual: skim the official doc for the mechanism named in this task
• Compare baselines: save measurements from the prior step so speedups are honest

For this exercise, you will use those habits while implementing the requirement in the starter code. Microarchitectural product names change across CPU generations, but the control ideas (fetch, bypass, cache lines, vector lanes) stay stable enough to debug from first principles.