Cybersecurity researchers from four major universities have disclosed a new processor-based vulnerability called BranchScope that is similar to Spectre/Meltdown, but which are immune to the fixes put in place that patch those vulnerabilities.
BranchScope was revealed in a paper by researchers at the College of William and Mary, Carnegie Mellon University, UC Riverside, and Binghamton University. It leverages the speculative execution capabilities found in most modern processors and can be used to circumvent memory protections implemented in the hardware and operating system level. The difference between BranchScope and Spectre/Meltdown is that while both are side-channel attacks that require manipulation of speculative execution, the new vulnerability is the first to focus on the shared branch target predictor, the researchers said.
When multiple processes execute on the same physical core, they share a single branch prediction unit (BPU). Doing this is helpful in regard to utilization and complexity, but the sharing potentially opens the door an attacker to manipulate the shared BPU state, create a side-channel, and derive a direction or target of a branch instruction executed by a victim process. Such leakage can compromise sensitive data, the report said.
“We demonstrate that BranchScope works reliably and efficiently from user space across three generations of Intel processors in the presence of system noise, with an error rate of less than 1%,” the report stated.
The group did come up with a few mitigation techniques.
Since BranchScope requires the ability create predictable collisions in the pattern history table (PHT), one defensive measure is to prevent such collisions by randomizing the PHT indexing function to receive as input some data unique to this software entity.
Another method involves removing the prediction for sensitive branches. This can be done by a software developer who can indicate the branches capable of leaking secret information and request them to be protected. “Then the CPU must avoid predicting these branches, rely always on static prediction and avoid updating any BPU structures after such branches are executed,” the paper suggested.
The final recommendation is partitioning the BPU in such a way that attackers and victims do not share the same structures.