Exorcising Spectres with Secure Compilers
Speculative execution attacks like Spectre can be used to violate confidentiality in all modern general-purpose CPUs. Recently, many compiler-level countermeasures have been proposed to mitigate the impact of Spectre-style attacks. However, the correctness and security of these countermeasures has not been ascertained yet. Even worse, while some of the existing countermeasures seem to be secure, others are known to be insecure and produce vulnerable programs.
In this paper we report on our ongoing effort towards formally reasoning about the effectiveness of these countermeasures. For this, we combine recent frameworks for reasoning about speculative information flows with a secure compilation theory telling that a compiler is secure when it preserves certain classes of (hyper)properties. We argue that Spectre-like attacks arise from violations of \emph{speculative non-interference}, a non-interference-like property. By lifting speculative non-interference to the secure compilation setting, we obtain a precise notion of security against Spectre-style attacks for compiler-level countermeasures. We believe that this criterion is the first step towards formally reasoning about the security of compiler-level countermeasures against Spectre-style attacks, and we discuss our research plan.
Exorcising Spectres with Secure Compilers (exorciseSpectre@prisc_pdf.pdf) | 9.10MiB |