tenpoku1000/side_channel.md

Last active April 29, 2024 05:31

Star (1) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Select an option

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/tenpoku1000/8d31abef480f6d7ea58f501c29855162.js"></script>
Save tenpoku1000/8d31abef480f6d7ea58f501c29855162 to your computer and use it in GitHub Desktop.

Download ZIP

投機的実行サイドチャネルハードウェア脆弱性

Raw

side_channel.md

投機的実行サイドチャネルハードウェア脆弱性

脆弱性対策として追加された CPUID/MSR

Deep Dive: CPUID Enumeration and Architectural MSRs
https://software.intel.com/security-software-guidance/insights/deep-dive-cpuid-enumeration-and-architectural-msrs

Deep Dive: Indirect Branch Restricted Speculation
https://software.intel.com/security-software-guidance/insights/deep-dive-indirect-branch-restricted-speculation

Deep Dive: Single Thread Indirect Branch Predictors
https://software.intel.com/security-software-guidance/insights/deep-dive-single-thread-indirect-branch-predictors

Deep Dive: Indirect Branch Predictor Barrier
https://software.intel.com/security-software-guidance/insights/deep-dive-indirect-branch-predictor-barrier

(1) CVE-2017-5753 Variant 1 Bounds Check Bypass

Deep Dive: Analyzing Potential Bounds Check Bypass Vulnerabilities
https://software.intel.com/security-software-guidance/insights/deep-dive-analyzing-potential-bounds-check-bypass-vulnerabilities

Spectre mitigations in MSVC | C++ Team Blog
https://devblogs.microsoft.com/cppblog/spectre-mitigations-in-msvc/

(2) CVE-2017-5715 Variant 2 Branch Target Injection

Mitigating Spectre variant 2 with Retpoline on Windows - Microsoft Tech Community - 295618
https://techcommunity.microsoft.com/t5/windows-kernel-internals/mitigating-spectre-variant-2-with-retpoline-on-windows/ba-p/295618

Deep Dive: Retpoline: A Branch Target Injection Mitigation
https://software.intel.com/security-software-guidance/insights/deep-dive-retpoline-branch-target-injection-mitigation

(3) CVE-2017-5754 Variant 3 Meltdown：rogue data cache load

Meltdown (security vulnerability) - Wikipedia
https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)

Kernel page-table isolation - Wikipedia
https://en.wikipedia.org/wiki/Kernel_page-table_isolation

KVA Shadow: Mitigating Meltdown on Windows - Microsoft Security Response Center
https://msrc-blog.microsoft.com/2018/03/23/kva-shadow-mitigating-meltdown-on-windows/

(4) CVE-2018-3639 Variant 4 Speculative Store Bypass

Speculative Store Bypass
https://software.intel.com/security-software-guidance/software-guidance/speculative-store-bypass

Analysis and mitigation of speculative store bypass (CVE-2018-3639) - Microsoft Security Response Center
https://msrc-blog.microsoft.com/2018/05/21/analysis-and-mitigation-of-speculative-store-bypass-cve-2018-3639/

(5) CVE-2018-3615/CVE-2018-3620/CVE-2018-3646 L1 Terminal Fault

Foreshadow (security vulnerability) - Wikipedia
https://en.wikipedia.org/wiki/Foreshadow_(security_vulnerability)

Deep Dive: Intel Analysis of L1 Terminal Fault | 01.org API
https://software.intel.com/security-software-guidance/api-app/insights/deep-dive-intel-analysis-l1-terminal-fault

(5) CVE-2018-12126/CVE-2018-12127/CVE-2018-12130/CVE-2019-11091 Microarchitectural Data Sampling

Microarchitectural Data Sampling - Wikipedia
https://en.wikipedia.org/wiki/Microarchitectural_Data_Sampling

Deep Dive: Intel Analysis of Microarchitectural Data Sampling
https://software.intel.com/security-software-guidance/insights/deep-dive-intel-analysis-microarchitectural-data-sampling

(6) CVE-2019-11135 Transactional Asynchronous Abort

Deep Dive: Intel® Transactional Synchronization Extensions (Intel® TSX) Asynchronous Abort
https://software.intel.com/security-software-guidance/insights/deep-dive-intel-transactional-synchronization-extensions-intel-tsx-asynchronous-abort

(7) CVE-2019-1125 Spectre SWAPGS gadget vulnerability

Deep Dive: Intel Analysis of Speculative Behavior of SWAPGS and Segment Registers
https://software.intel.com/security-software-guidance/insights/deep-dive-intel-analysis-speculative-behavior-swapgs-and-segment-registers

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment