Overtake: Achieving Meltdown-type Attacks with One Instruction

In early 2018, the Meltdown attack was reported, which steals secret data by loading and then encoding them into the cache covert channel during the invisible transient executions. After that, a set of Meltdown-type attacks are proposed; those attacks largely threaten the security of modern processors. In this study, we review Intel's x86-64 Instruction Set Architecture (ISA) and find two vulnerable instructions (CMPSB and SCASB) that can be exploited to achieve the Meltdown-type attacks with few instructions. Especially, the CMPSB instruction itself is enough to implement the core part of the Meltdowntype attacks. We design a special cache-based and Performance Monitor Unit (PMU)-based covert channel to recover the secret data for the two instructions. In our experiments, we demonstrate the availability of the two instructions by implementing the Meltdown and ZombieLoad attacks with them. Compared to the original Meltdown-type attacks, the proposed attack can be considered as an attack that does not rely on the transient executions from the perspective of the macro instruction level because no more macro instruction is executed after triggering the exception. Therefore, we name our attacks Overtake. Our experiments indicate that the average data leakage speed of Overtake attack could reach 770.1 KB/s with an error rate of 0.4 %.