Breaking The Buffer : Covert Channel Attacks by Overrunning Buffer and Countermeasures

The large capacity and energy-efficient shared Last Level Caches play a vital role in improving system performance with a relatively low power consumption in the modern processors. Unfortunately, this highly utilized shared resource often turns out to be a primary target for some malicious attackers. In particular, depending on the inherent timing difference between a cache hit and a miss, attackers in the form of malicious applications running on different cores can exchange information in an indirect manner, creating a so-called covert channel. Although many such attacks and their countermeasures have been proposed in the literature, the possibility of a newer variant cannot be underestimated. This paper presents a novel covert channel attack that exploits the vulnerabilities in the existing buffer-based defence mechanism against Last Level Cache (LLC) timing attacks. Building upon the Flush+earlyReload (F+eR) attack mechanism, we demonstrate a new attack that targets the fixed buffer size limitations in the current defence implementation against F+eR. Our attack, termed “Buffer Saturation Attack” (BSA), exploits the predictability of buffer capacity and the already in-place First In First Out (FIFO) eviction policy to create reliable covert channels for transmission of confidential information between malicious applications called spy and trojan . Furthermore, we propose a defence mechanism called Request Capping (ReCap) that identifies and subsequently prevents the malicious activities by limiting the number of consecutive requests from each individual core. Through experimental analysis, we show that BSA can achieve high transmission accuracy by strategically overwhelming the buffer with carefully timed requests.