Example of using revealed "Spectre" exploit (CVE-2017-5753 and CVE-2017-5715)
Branch: master
Clone or download
Latest commit 1f055ae Jan 10, 2018
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitignore Initial commit Jan 4, 2018
Makefile Create Makefile Jan 5, 2018
README.md Added instructions Jan 10, 2018
Source.c Added pointer address output Jan 10, 2018

README.md

Spectre Attack Example

Example of using revealed "Spectre" exploit from 2 Jan 2018 (CVE-2017-5753 and CVE-2017-5715)

Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.

Language

C, uses libs:

  • stdio.h
  • stdint.h
  • intrin.h - for rdtscp and clflush

What's example do?

We're putting text "The Magic Words are Squeamish Ossifrage." in memory and then we're trying to read it using exploit. If system is vulnerable, you'll see same text in output, read from memory.


In this code, if the compiled instructions in victim_function() were executed in strict program order, the function would only read from array1[0..15] since array1 size = 16. However, when executed speculatively, out-of-bounds reads are possible. The readMemoryByte() function makes several training calls to victim_function() to make the branch predictor expect valid values for x, then calls with an out-of-bounds x. The conditional branch mispredicts, and the ensuing speculative execution reads a secret byte using the out-of-bounds x. The speculative code then reads from array2[array1[x] * 512], leaking the value of array1[x] into the cache state. To complete the attack, a simple flush+probe is used to identify which cache line in array2 was loaded, revealing the memory contents. The attack is repeated several times, so even if the target byte was initially uncached, the first iteration will bring it into the cache.

The unoptimized code reads approximately 10KB/second on an i7 Surface Pro 3.

Building

Using GCC

gcc -std=c99 Source.c -o spectre.out or make

Using Visual Studio

Create new empty project and add Source.c then click on Build.

Executing

Test

.\spectre.out with no params.

Read from address

.\spectre.out {address} {length} with params:

  • address - pointer address of victim char *
  • length - length of char *

Sources