TLB;DR: Enhancing TLB-based Attacks with TLB Desynchronized Reverse Engineering presented at USENIX Security 2022

by Andrei Tatar,

Tags: Hardware Security I: Attacks & Defenses

URL : https://www.usenix.org/system/files/sec22-tatar.pdf

Summary : Translation Lookaside Buffers, or TLBs, play a vital role in recent microarchitectural attacks. However, unlike CPU caches, we know very little about the exact operation of these essential microarchitectural components. In this paper, we introduce TLB desynchronization as a novel technique for reverse engineering TLB behavior from software. Unlike previous efforts that rely on timing or performance counters, our technique relies on fundamental properties of TLBs, enabling precise and fine-grained experiments. We use desynchronization to shed new light on TLB behavior, examining previously undocumented features such as replacement policies and handling of PCIDs on commodity Intel processors. We also show that such knowledge allows for more and better attacks.