Detection of Sensitive Information Based on Transient Data in Store Buffer and Cache

To investigate side-channel vulnerabilities in the microarchitecture of multicore processors and develop effective protection strategies, we analyze the primitives of the transient attack known as Meltdown. Our study reveals that the relative window of the exception handler significantly impacts the attack's effectiveness. Focusing on the Intel Skylake architecture, we conduct a comparative analysis between the memory order buffer (MOB), which regulates the execution order of load and store instructions, and the multi-level cache, which enhances data access efficiency. Our findings indicate that threads sharing resources within the core can exploit load instructions to directly access data stored by other users in the store buffer. Additionally, the data reside in cache, influenced by the Least Recently Used (LRU) policy, is particularly vulnerable to data leakage through side-channel attacks. By leveraging transient data from the store buffer and cache, the relative window of the exception handler can be expanded, we demonstrate that incorporating Meltdown can facilitate a transient attack that successfully retrieves the complete communication key of OpenSSH AES.