Meltdown and Spectrum are vulnerabilities discovered in Intel processors that can be exploited to access internal registers, kernel memory and host memory. Several approaches to solutions have already been made. A mitigation technique called Retpoline has been published by Google. The big Redmond company, Microsoft, has made available a PowerShell tool to make the inventory of the protections under Windows. Linux also made patches against Meltdown and Specter in its 4.16 kernel. Despite all these efforts, no definitive and corrective solution is yet in place, as other vulnerabilities continue to be discovered in Intel’s CPUs.
It is with a view to making a difference that researchers at the Universities of California, William and Mary, and Binghamton have developed a new “design principle” called SafeSpec to overcome the vulnerabilities of Meltdown and Specter and many others. These principles, contained in a very detailed document, make it possible to avoid speculative execution vulnerabilities. Recall that speculative execution is a standard microarchitectural technique used in virtually all modern processors to improve their performance. The speculatively executed instructions may leave traces in the caches of the processors. This vulnerability can be exploited by an attacker to access information in a speculative way. Meltdown and Spectrum are one example.
The researchers say the SafeSpec model supports “speculation to protect against leaks needed for attacks such as Meltdown and Spectrum”. In a document titled “SafeSpec: Banishing the Specter of a Meltdown with Leakage-Free Speculation,” researchers say they “explore whether speculation can be made without leakage in a principled manner, allowing CPUs to conserve their performance advantage of speculation while removing the security vulnerabilities it exposes. ” SafeSpec therefore stores the speculative state “in temporary structures that are not accessible by committed instructions”.
The research team also announces in its paper that SafeSpec does not terminate Google’s Retpoline technique and that it does not suffer from any of the performance issues associated with the Meltdown and Specter patches, but rather helps to improve processor performance. SafeSpec is not only a fix against the different known variants of Meltdown and Spectrum, but also against new variants discovered by researchers. The researchers believe SafeSpec “represents a first step towards principled protection” against these vulnerabilities. There is still some way to go before these vulnerabilities in Intel CPUs are completely eradicated.