Translation leak-aside buffer : Defeating cache side-channel protections with TLB attacks

TLDR

Defenses have isolated CPU caches to stop side‑channel attacks, but other shared resources such as TLBs were assumed too coarse‑grained to leak information, though exploiting them is difficult due to unknown addressing functions and limited monitoring. The paper demonstrates that TLBs can leak fine‑grained victim activity even under state‑of‑the‑art cache protections. We reverse‑engineered the unknown TLB addressing function on recent Intel processors and developed a machine‑learning approach that exploits high‑resolution temporal features of victim memory activity. Our prototype, TLBleed, can recover a 256‑bit EdDSA key in 17 s with 98 % success and reconstruct 92 % of RSA keys from a hardened implementation, even with state‑of‑the‑art cache isolation.

Abstract

To stop side channel attacks on CPU caches that have allowed attackers to leak secret information and break basic security mechanisms, the security community has developed a variety of powerful defenses that effectively isolate the security domains. Of course, other shared hardware resources exist, but the assumption is that unlike cache side channels, any channel offered by these resources is insufficiently reliable and too coarse-grained to leak general-purpose information. This is no longer true. In this paper, we revisit this assumption and show for the first time that hardware translation lookaside buffers (TLBs) can be abused to leak fine-grained information about a victim's activity even when CPU cache activity is guarded by state-of-the-art cache side-channel protections, such as CAT and TSX. However, exploiting the TLB channel is challenging, due to unknown addressing functions inside the TLB and the attacker's limited monitoring capabilities which, at best, cover only the victim's coarse-grained data accesses. To address the former, we reverse engineer the previously unknown addressing function in recent Intel processors. To address the latter, we devise a machine learning strategy that exploits high-resolution temporal features about a victim's memory activity. Our prototype implementation, TLBleed, can leak a 256-bit EdDSA secret key from a single capture after 17 seconds of computation time with a 98% success rate, even in presence of state-of-the-art cache isolation. Similarly, using a single capture, TLBleed reconstructs 92% of RSA keys from an implementation that is hardened against FLUSH+RELOAD attacks.