Cache Wars: A Comparative Study of UMWAIT, UMONITOR, and Prime-Probe Attacks

UMONITOR and UMWAIT are special instructions that have been introduced in the newer age Intel micro-architecture, specifically Tremont and subsequent generations, to optimize idle loops in processors. In this paper, we introduce a new class of micro-architectural attacks using nothing but some user-level instructions. These instructions can monitor target cache lines and send back a signal on sensing activity on those cache lines. We have introduced a new attack primitive named Umprime + Umprobe attack, which is much simpler and more efficient than the classical prime + probe class of attacks. In addition to this, we have demonstrated the adaptability of the threat model with the following case scenarios: a) website fingerprinting with the help of umwait and umonitor instructions; b) we have also performed process fingerprinting with the help of our attack primitive. We also show that these user-privileged instructions could be used to create timer-less covert channels between cores and to show how full-fledged information leakage assessments can be done with cache coherency protocols. We have carried out all our experiments on the Intel 12th Generation Alder Lake processor.