LeakageFreeSpec: Applying the Wiping Approach to Defend Against Transient Execution Attacks

Transient Execution Attacks, such as Spectre and Meltdown, pose significant challenges to processor security. While various defense strategies have been proposed, they often suffer from issues like high-performance overhead and incomplete coverage. This paper introduces a novel hardware-based mitigation approach known as LeakageFreeSpec to address transient execution attacks.

Our key insight is that transient execution attacks leak sensitive information through observable, persistent microarchitecture traces generated by mis-speculated instructions. LeakageFreeSpec dynamically monitors the instruction flow in an out-of-order processor and wipes the persistent microarchitecture traces created by potentially dangerous instructions. This ensures that most of the performance benefits of speculative execution are maintained, as LeakageFreeSpec doesn't block speculation.

We designed SquashAbleCache in accordance with the principles of LeakageFreeSpec, allowing it to eliminate all cache traces created by mis-speculated load instructions. As a result, SquashAbleCache provides protection against a wide range of transient execution attacks that exploit cache side channels. We implemented SquashAbleCache and evaluated its security in the context of the Spectre v1 attack. Our simulations, conducted using SPEC and PARSEC workloads, demonstrate the effectiveness of SquashAbleCache. It incurs only a negligible average performance overhead of 0.71% in defending against a broad spectrum of transient execution attacks that exploit cache side channels. In contrast to the state-of-the-art design known as GhostMinion, which has an average performance overhead of 2.2%, SquashAbleCache offers comparable performance with minimal data movements, as the majority of the processor's predictions are correct.