Translation Leak-aside Buffer: Defeating Cache Side-channel Protections

on YouTube ↗27m

" summary

Shows a practical TLB-based channel that bypasses cache defenses by reverse-engineering Intel TLB hashing, building a probe that times L1/L2 translation sets and classifies temporal patterns with an SVM. Prototype TLBleed recovers a 256-bit EdDSA key from one capture in ~17s with 98% success rate, and reconstructs ~92% of RSA bits from a FLUSH+RELOAD-hardened implementation; relies on hyperthread sharing and page-granularity TLB sets.

AI-written summary · about

" chapters (15)

1. 0:00Introduction and context
2. 2:04Side-channel attack basics
3. 4:24Analyzing cache traces
4. 6:09Intel TSX cache defenses
5. 7:33Understanding the TLB
6. 9:00Reverse engineering the TLB
7. 11:02Hash functions in the TLB
8. 11:58Hyper-thread sharing
9. 13:51Microarchitectural findings
10. 14:36Latency-based monitoring
11. 16:12TLB attack implementation
12. 17:11SVM classifier application
13. 19:12Experimental results
14. 20:55Conclusion and reception
15. 23:19Q&A session

" related talks

• 15mI Know What You Said: Unveiling Hardware Cache Side-Channels in Local LargeZibo Gao, Junjie Hu, Feng Guo, Yixin Zhang, Yinglong Han, Siyuan Liu, Haiyang Li, Zhiqiang Lv · USENIX Security '25
• 36mStore-to-Leak Forwarding: There and Back AgainMichael Schwarz, Lukas Giner, Claudio Canella · Black Hat Asia 2020
• 28mStrong and Efficient Cache Side-Channel Protection...Felix Schuster, Daniel Gruss, Manuel Costa, Julian Lettner, Olya Ohrimenko, Istvan Haller · 26th USENIX Security Symposium (USENIX Security '17)
• 01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...Allison Randal, Giorgos Christou · RISC-V Summit 2022
• 43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the ProcessDaniel Gruss, Anders Fogh · Black Hat USA 2016
• 28mPrime+Abort: A Timer-Free High-Precision L3 Cache Attack using Intel TSXCraig Disselkoen, Dean Tullsen, David Kohlbrenner, Leo Porter · 26th USENIX Security Symposium (USENIX Security '17)
• 41mUsing Microarchitectural Design to Break KASLR and MoreAnders Fogh · RuhrSec 2017
• 20mA Formal Model of Cache Speculation Side-ChannelsCatalin Marinas · TLA+ Community Event 2020