Abstract:A new class of transient execution-based attacks, as known as Microarchitectural Data Sampling (MDS), were discovered in recent studies, such as RIDL, Fallout, and ZombieLoad, which have imposed severe threats to general-purpose processors. In MDS attacks, the attacker can steal the information from privileged CPU internal buffers, such as store buffers, line fill buffers, and load ports. To prevent these buffers from leaking information, processor vendors proposed mitigation via microcode update that overwrites CPU internal buffers as soon as the privilege levels are changed. However, the problem if a given architecture is safe against MDS attacks is still to be fully solved.In this study, we propose a formal verification method based on model checking to verify the microarchitectural security against MDS attacks. We formulate the MDS attacks as operation sequences, and set up a behavior model to describe the microarchitectural design correlated MDS attacks. A operation sequence is considered as an MDS attack if the operation sequence can obtain transient illegal data leaked from internal buffers during the operations. We enumerate all the possible sequences by binary decision diagram (BDD)-based statechart traversal, and output all the counterexamples. The experimental results show that the proposed method can sufficiently check the MDS attacks, and a kind of attack is detected to be able to bypass the mitigation proposed by Intel, which was contemporarily proposed as CacheOut attack.

Systematic Classification of Attackers via Bounded Model Checking

Quantifying Attacker Capability Via Model Checking Multiple Properties (Extended Version)

Think That Attackers Think: Using First-Order Theory of Mind in Intrusion Response System.

Critical Checkpoints for Evaluating Defence Models Against Adversarial Attack and Robustness

Model Checking for Microarchitectural Data Sampling Security

From Wireless Sensor Networks to Wireless Body Area Networks: Formal Modeling and Verification on Security Using PAT.

Bridging the Gap: Automated Analysis of Sancus

Verifying Security Vulnerabilities in Large Software Systems using Multi-Core k-Induction

Systematic Classification of Side-Channel Attacks: A Case Study for Mobile Devices

Practical and Scalable Security Verification of Secure Architectures

Discovering, quantifying, and displaying attacks

Cross-level Monte Carlo Framework for System Vulnerability Evaluation Against Fault Attack

Yoneda Hacking: The Algebra of Attacker Actions

SoK: Security in Real-Time Systems

Defence and Attack of Systems with Variable Attacker System Structure Detection Probability

SCVerify: Verification of Software Implementation Against Power Side-Channel Attacks

A Hierarchical Model for Distributed Attacks

Detection and Mitigation of Classes of Attacks in Supervisory Control Systems

Detecting Missing Checks for Identifying Insufficient Attack Protections

Formal Mental Models for Human-Centered Cybersecurity

Systematic Attack Surface Reduction For Deployed Sentiment Analysis Models