Quote:Are buffer overwrites sufficient to block MDS-type attacks? In particular, can an adversary exploit the still leaky CPU buffers in Intel CPUs despite their content being properly overwritten?

Quote:Is it possible for the attacker to leak information across arbitrary address spaces, while somehow retaining the capability of selecting which data to leak? If so, how can such attack be implemented in the presence of existing MDS countermeasures?

Quote:Is HyperThreading essential for mounting MDS type attacks? How can an adversary recover data without the use of Hyper-Threading in the presence of proper buffer overwrite between security domains?

• They presented CacheOut, which they describe as "the first speculative execution attack that can leak across arbitrary address spaces while still retaining fine grained control over what data to leak. Moreover, unlike other MDS-type attacks, CacheOut cannot be mitigated by simply flushing internal CPU buffers between context switches, even when hyperthreading is disabled."
  
• They demonstrate the effectiveness of CacheOut in violating process isolation by recovering AES keys and plaintexts from an OpenSSL-based victim.
  
• They demonstrate practical exploits for completely derandomizing Linux’s kernel ASLR, and for recovering secret stack canaries from the Linux kernel (this one will certainly bug Linus Torvald.)
  
• They demonstrate how CacheOut is effective for violating isolation between two virtual machines running on the same physical core. (This one is for the Cloud industry.)
  
• They breach SGX’s confidentiality guarantees by reading out the contents of a secure enclave.
  
• They demonstrate that some of the latest Meltdown-resistant Intel CPUs are still vulnerable, despite all of the most recent patches and mitigations.
  
• They discuss why current speculative attack mitigations are insufficient, and offer suggestions on what countermeasures would effectively mitigate CacheOut.
  

Quote:(...) Intel recently published microcode updates that enable turning off Transactional Memory Extension (TSX) on its CPUs. These are also effective against CacheOut and we recommend that TSX be turned off across all current Intel platforms. Finally, Intel’s security advisory [23] indicates that microcode updates mitigating CacheOut (called L1DES in Intel’s terminology) will be published with the public disclosure of our results. We recommend these be installed on affected Intel platforms.