A Principled Plan to Prevent Transient Execution Attacks

Introduction

Ghostbuster is a research program to stop advanced “transient execution attacks,” which by themselves already rank among the most advanced attacks ever. The program aims to find vulnerable code fragments, analyze them for exploitability, and inject mitigations where needed.

Background on Vulnerabilities

The vulnerabilities such as Spectre, Meltdown, and others originate in vulnerable hardware and allow data leakage across all security boundaries. Recently, my team and I showed that even more advanced attacks exist by combining transient execution with traditional software exploitation.

Current Challenges

Today, we have no way of even detecting these hybrid attacks, let alone stopping them. While we keep finding new variants, vendors have indicated that they cannot fix them all, as it would cripple performance. The hope is that developers identify and harden vulnerable code snippets (e.g., with instructions that stop transient execution). Unfortunately, finding vulnerable snippets is hard, beyond the abilities of top programmers, and even more so for the new hybrid attacks.

Automation Possibility

Can it be done automatically? The challenge is daunting and involves all interaction between the code and a myriad of obscure CPU resources, requiring expertise in hardware, operating systems, fuzzing, program analysis, etc. State-of-the-art (and limited) tools do not even aim for mitigation and simply report potential issues—with many false positives and negatives.

Ghostbuster's Approach

Unlike existing solutions that detect the snippets through pattern matching, Ghostbuster takes a principled approach and considers the fundamental conditions enabling attacks. It avoids resorting to symbolic execution, which scales poorly to large programs.

Modeling Attacks

Ghostbuster models the fundamental conditions of (steps of) an attack in terms of control and dataflow properties and translates the models into detectors. After detecting the code that looks vulnerable, it runs additional (possibly heavy-weight) exploitability analysis and, if need be, mitigates the issue by removing some of the enabling conditions.