Uncore Encore: Covert Channels Exploiting Uncore Frequency Scaling
Yanan Guo, Dingyuan Cao, Xin Xin, Youtao Zhang, Jun Yang
摘要
Modern processors dynamically adjust clock frequencies and voltages to reduce energy consumption. Recent Intel processors separate the uncore frequency from the core frequency, using Uncore Frequency Scaling (UFS) to adapt the uncore frequency to various workloads. While UFS improves power efficiency, it also introduces security vulnerabilities. In this paper, we study the feasibility of covert channels exploiting UFS. First, we conduct a series of experiments to understand the details of UFS, such as the factors that can cause uncore frequency variations. Then, based on the results, we build the first UFS-based covert channel, UF-variation, which works both across-cores and across-processors. Finally, we analyze the robustness of UF-variation under known defense mechanisms against uncore covert channels, and show that UF-variation remains functional even with those defenses in place.
问问这篇 Paper
智能体会读完全文。
Lune 把这篇 Paper 索引到了每一个公式,引用它的顶会 Paper 也一样。你提问,回答直接引用原文。
引用它的顶会 Paper3
- Veiled Pathways: Investigating Covert and Side Channels Within GPU UncoreYuanqing Miao, Yingtian Zhang, Dinghao Wu, Danfeng Zhang 等MICRO 2024 · 被引用 8 次
- Memory Band-Aid: A Principled Rowhammer Defense-in-DepthCarina Fiedler, Jonas Juffinger, Sudheendra Raghav Neela, Martin Heckel 等NDSS 2026 · 被引用 5 次
- Practice Makes (Im)Perfect: A Look Back at Benchmarking Practices for Microarchitectural Side-Channel AttacksIliana Fayolle, Antoine Geimer, Daniel De Almeida Braga, Clémentine MauriceCCS 2026
它引用的顶会 Paper28
- DRAMA: Exploiting DRAM Addressing for Cross-CPU AttacksPeter Pessl, Daniel Gruss, Clémentine Maurice, Michael Schwarz 等USENIX Security 2016 · 被引用 500 次
- Translation Leak-aside Buffer: Defeating Cache Side-channel Protections with TLB AttacksBen Gras, Kaveh Razavi, Herbert Bos, Cristiano GiuffridaUSENIX Security 2018 · 被引用 357 次
- Attack Directories, Not Caches: Side Channel Attacks in a Non-Inclusive WorldMengjia Yan, Read Sprabery, Bhargava Gopireddy, Christopher W. Fletcher 等S&P 2019 · 被引用 201 次
- Prime+Abort: A Timer-Free High-Precision L3 Cache Attack using Intel TSXCraig Disselkoen, David Kohlbrenner, Leo Porter, Dean M. TullsenUSENIX Security 2017 · 被引用 186 次
- Hello from the Other Side: SSH over Robust Cache Covert Channels in the CloudClémentine Maurice, Manuel Weber, Michael Schwarz, Lukas Giner 等NDSS 2017 · 被引用 174 次
相关 Paper
- IChannels: Exploiting Current Management Mechanisms to Create Covert Channels in Modern ProcessorsJawad Haj-Yahya, Lois Orosa, Jeremie S. Kim, Juan Gómez-Luna 等ISCA 2021 · 被引用 19 次
- Cross-VM and Cross-Processor Covert Channels Exploiting Processor Idle Power ManagementPaizhuo Chen, Lei Li, Zhice YangUSENIX Security 2021 · 被引用 7 次
- Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86Yingchen Wang, Riccardo Paccagnella, Elizabeth Tang He, Hovav Shacham 等USENIX Security 2022
- Plundervolt: Software-based Fault Injection Attacks against Intel SGXKit Murdock, David F. Oswald, Flavio D. Garcia, Jo Van Bulck 等S&P 2020 · 被引用 369 次
- PREFETCHX: Cross-Core Cache-Agnostic Prefetcher-based Side-Channel AttacksYun Chen, Ali Hajiabadi, Lingfeng Pei, Trevor E. CarlsonHPCA 2024 · 被引用 15 次
