Defeating Transient Execution Attacks by Limiting Secret Reachability Through Register Hiding and ShadowCFI

Modern processors incorporate aggressive branch prediction mechanisms for indirect branches, offering various unanticipated ways to influence speculative behavior during a transient execution attack. Existing mitigations against these so-called Spectre v2-style attacks are often ad-hoc, highly specific to the discovered attack and the targeted microarchitecture, and thus fail to generalize. In this paper, we identify a core requirement previously overlooked that all of these attacks share: secret reachability. Building upon this, we propose Register Hiding and ShadowCFI, two complementary but independent software-based and hardware-agnostic techniques which target the attacker's ability to reach secrets in registers and memory. Register Hiding hides the architectural register state before a misprediction can occur, while ShadowCFI ensures the architectural register state can only be restored at the correct target. To demonstrate their merit, we implement a fully functional patch for Linux kernel version 6.8.0, protecting against known and futuristic Spectre v2-style attacks, including all those which target indirect jumps, indirect calls and returns. We provide a security analysis and corresponding scanner to verify that an attacker cannot restore the register state during misprediction in our proof-of-concept. Replacing the most recently deployed Spectre v2 defenses with Register Hiding and ShadowCFI reduces the overall mitigation overhead on AMD Zen 4 from 114.1% to 75.9% for LEBench, and from 33.4% to 25.8% on average across server workloads.