Thursday 10 April 2025
The latest development in microarchitectural attacks has left security researchers and enthusiasts alike scratching their heads. Intel’s introduction of a new instruction, cldemote, which is designed to promote efficient data sharing by transferring cache lines from upper-level caches to the Last Level Cache (LLC), has inadvertently created a new attack surface.
The team behind this research discovered that cldemote can be exploited to construct a covert channel with a bandwidth of 2.84 Mbps and a bit error rate of 0.018%. This means that an attacker could potentially send data through the LLC, evading traditional security measures such as memory access controls and encryption.
The researchers demonstrated two new attack primitives: Flush+Demote and Demote+Time. Flush+Demote constructs a covert channel by manipulating cache lines in the LLC to transmit data between cores. Demote+Time, on the other hand, exploits the timing differences between page table walks at different levels of the memory hierarchy.
The team used the cldemote instruction to measure the execution time of address translation at various page table levels. They found that the shortest execution time was recorded when address translation completed at the Page Table (PT) level, while longer times were observed for higher-level page tables.
This research highlights the importance of considering microarchitectural components in the design and implementation of security measures. The introduction of new instructions like cldemote may inadvertently create new attack surfaces that can be exploited by attackers.
The researchers’ findings also underscore the need for more robust and sophisticated memory access controls, as well as the development of novel techniques to detect and mitigate microarchitectural attacks.
In addition to its implications for security, this research has important practical applications. It demonstrates the feasibility of constructing covert channels using cldemote, which could be used to transfer data between cores without being detected by traditional security mechanisms.
The team’s experiments also showed that different types of eviction sets can significantly impact access latencies on target addresses. They found that LLC hits were consistently faster than L1 and L2 hits, while DRAM accesses took the longest time.
This research serves as a reminder that microarchitectural attacks are an ongoing concern in the security community. As new instructions and components are introduced to improve system performance, it is essential to consider their potential impact on security.
The team’s work highlights the importance of continued research into microarchitectural attacks and the development of novel techniques to mitigate them.
Cite this article: “Demoting Security: Uncovering Hidden Channels in Modern Processors”, The Science Archive, 2025.
Microarchitectural Attacks, Covert Channels, Cldemote Instruction, Last Level Cache, Llc, Cache Lines, Flush+Demote, Demote+Time, Page Table Walks, Memory Hierarchy.
