Skip to content

Example of using revealed "Spectre" exploit (CVE-2017-5753 and CVE-2017-5715)

Notifications You must be signed in to change notification settings

Eugnis/spectre-attack

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

29 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Spectre Attack Example

Example of using revealed "Spectre" exploit from 2 Jan 2018 (CVE-2017-5753 and CVE-2017-5715)

Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.

Language

C, uses libs:

  • stdio.h
  • stdint.h
  • intrin.h - for rdtscp and clflush

What's example do?

We're putting text "The Magic Words are Squeamish Ossifrage." in memory and then we're trying to read it using exploit. If system is vulnerable, you'll see same text in output, read from memory.


In this code, if the compiled instructions in victim_function() were executed in strict program order, the function would only read from array1[0..15] since array1 size = 16. However, when executed speculatively, out-of-bounds reads are possible. The readMemoryByte() function makes several training calls to victim_function() to make the branch predictor expect valid values for x, then calls with an out-of-bounds x. The conditional branch mispredicts, and the ensuing speculative execution reads a secret byte using the out-of-bounds x. The speculative code then reads from array2[array1[x] * 512], leaking the value of array1[x] into the cache state. To complete the attack, a simple flush+probe is used to identify which cache line in array2 was loaded, revealing the memory contents. The attack is repeated several times, so even if the target byte was initially uncached, the first iteration will bring it into the cache.

The unoptimized code reads approximately 10KB/second on an i7 Surface Pro 3.

Building

Using GCC

gcc -std=c99 Source.c -o spectre.out or make

Using Visual Studio

Create new empty project and add Source.c then click on Build.

Executing

Test

.\spectre.out with no params.

Read from address

.\spectre.out {address} {length} with params:

  • address - pointer address of victim char *
  • length - length of char *

Sources

About

Example of using revealed "Spectre" exploit (CVE-2017-5753 and CVE-2017-5715)

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published