oo7: Low-Overhead Defense Against Spectre Attacks via Program Analysis
| Autor: | Ivan Gotovchits, Guanhua Wang, Abhik Roychoudhury, Sudipta Chattopadhyay, Tulika Mitra |
|---|---|
| Rok vydání: | 2021 |
| Předmět: |
FOS: Computer and information sciences
Computer Science - Cryptography and Security Computer science Speculative execution 020207 software engineering 02 engineering and technology Static analysis computer.software_genre Computer security Program analysis Taint checking Control flow 0202 electrical engineering electronic engineering information engineering Malware Compiler Cache Cryptography and Security (cs.CR) computer Software SPECint Vulnerability (computing) |
| Zdroj: | IEEE Transactions on Software Engineering. 47:2504-2519 |
| ISSN: | 2326-3881 0098-5589 |
| DOI: | 10.1109/tse.2019.2953709 |
| Popis: | The Spectre vulnerability in modern processors has been widely reported. The key insight in this vulnerability is that speculative execution in processors can be misused to access the secrets. Subsequently, even though the speculatively executed instructions are squashed, the secret may linger in micro-architectural states such as cache, and can potentially be accessed by an attacker via side channels. In this paper, we propose oo7, a static analysis approach that can mitigate Spectre attacks by detecting potentially vulnerable code snippets in program binaries and protecting them against the attack by patching them. Our key contribution is to balance the concerns of effectiveness, analysis time and run-time overheads. We employ control flow extraction, taint analysis, and address analysis to detect tainted conditional branches and speculative memory accesses. oo7 can detect all fifteen purpose-built Spectre-vulnerable code patterns, whereas Microsoft compiler with Spectre mitigation option can only detect two of them. We also report the results of a large-scale study on applying oo7 to over 500 program binaries (average binary size 261 KB) from different real-world projects. We protect programs against Spectre attack by selectively inserting fences only at vulnerable conditional branches to prevent speculative execution. Our approach is experimentally observed to incur around 5.9% performance overheads on SPECint benchmarks. To appear in IEEE Transactions on Software Engineering, 2020 |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|