论文标题
耐MDS的第十代英特尔核心（ICE Lake）的数据采样
Data Sampling on MDS-resistant 10th Generation Intel Core (Ice Lake)
论文作者
论文摘要
Microarchitectural Data采样（MDS）是Intel CPU中的一组硬件漏洞，允许攻击者从各种安全边界的内存负载和存储中泄漏数据字节。在受影响的CPU上，其中一些漏洞是通过Microcode更新修补的。此外，英特尔宣布，最新的微体系结构，即喀斯喀特湖和冰湖，不受MD的影响。尽管喀斯喀特湖很容易受到僵尸AD V2 MDS攻击（也称为TAA）的攻击，但Ice Lake不受这次袭击的影响。 在这份技术报告中，我们显示了MSBD（CVE2018-12126）的一种变体，这是一项在Ice Lake CPU上工作的MDS攻击，也称为辐射。该变体是使用Transynther自动合成的，该工具是找到熔融型攻击的新变体的工具。根据跨性别的发现，我们分析了有关此问题的不同微型编码，这表明只有2020年1月以后的微码版本才能阻止剥削脆弱性。这些结果表明，Transynther是找到新变体的有价值工具，并且还测试了可能带有Microcode更新的回归。
Microarchitectural Data Sampling (MDS) is a set of hardware vulnerabilities in Intel CPUs that allows an attacker to leak bytes of data from memory loads and stores across various security boundaries. On affected CPUs, some of these vulnerabilities were patched via microcode updates. Additionally, Intel announced that the newest microarchitectures, namely Cascade Lake and Ice Lake, were not affected by MDS. While Cascade Lake turned out to be vulnerable to the ZombieLoad v2 MDS attack (also known as TAA), Ice Lake was not affected by this attack. In this technical report, we show a variant of MSBDS (CVE2018-12126), an MDS attack, also known as Fallout, that works on Ice Lake CPUs. This variant was automatically synthesized using Transynther, a tool to find new variants of Meltdown-type attacks. Based on the findings of Transynther, we analyze different microcodes regarding this issue, showing that only microcode versions after January 2020 prevent exploitation of the vulnerability. These results show that Transynther is a valuable tool to find new variants, and also to test for regressions possibly introduced with microcode updates.
