Microarchitectural Minefields: 4K-Aliasing Covert Channel and Multi-Tenant Detection in Iaas Clouds
Dean Sullivan, Orlando Arias, Travis Meade, Yier Jin · 2018
We introduce a new microarchitectural timing covert channel using the processor memory order buffer (MOB).Specifically, we show how an adversary can infer the state of a spy process on the Intel 64 and IA-32 architectures when predicting dependent loads through the store buffer, called 4K-aliasing.The 4K-aliasing event is a side-effect of memory disambiguation misprediction while handling write-after-read data hazards wherein the lower 12-bits of a load address will falsely match with store addresses resident in the MOB.In this work, we extensively analyze 4K-aliasing and demonstrate a new timing channel measureable across processes when executed as hyperthreads.We then use 4K-aliasing to build a robust covert communication channel on both the Amazon EC2 and Google Compute Engine capable of communicating at speeds of 1.28 Mbps and 1.49 Mbps, respectively.In addition, we show that 4K-aliasing can also be used to reliably detect multi-tenancy.We address the second assumption by demonstrating a new SMT-based covert channel on both the Amazon EC2 and GCE IaaS platform.We show that it is capable of detecting multi-tenancy with equivalent success rate to other cross core multi-tenant detection schemes at comparable cost.Using two