The chaos unleashed by Meltdown and Specter earlier this year has had a huge impact on both Intel processors and other processors and products and services manufacturers that use those processors.
The situation has improved, but even the Intel processors launched in recent days still lack a complete and native hardware solution. Now MIT engineers have devised a way to address part of the problem, and the truth is that the method is at least ingenious, especially when they explain it as if they were talking about recipes.
Speculative execution helped us until we stopped doing it
The variants of Meltdown and Specter had the same basic pillar of operation: when an application needs to store something in memory, it asks the processor where to place that data. As site search is a slow process, Intel started using a striking and remarkable technique in 1995: speculative execution.
This technique allowed the processor to look for gaps in the memory in which to store data that it expected applications to be asking for. With this, the processor “predicted” the needs of the user, speculated on those needs, and that allowed to gain time because when the application needed to save the data, the processor was ready to give that space to the application.
We gained time and there did not seem to be any problems because the prediction failures were totally assumable: it more than compensated to make use of that predictive capability of the processors.
The problem is that with Meltdown and Specter it was discovered that an attacker could use that same technique to access parts of the memory that he should never have access to. Parties through which they could collect sensitive and private data. The disaster was served.
The discovery of the problem generated a rapid response from both Intel, the main affected, as many other companies whose products had also been directly or indirectly harmed by these vulnerabilities.
Companies like Microsoft, Apple, Google or AMD worked in different patches that combined or alone managed to mitigate the problem, but none of these solutions is total, since the chips need to be redesigned from scratch to stop using this type of technique, and for now Intel processors are still exposed.
It is true that the combination of some native hardware fixes attached to the microcode patches or operating system updates mitigate most problems, but the risk still exists. And that’s where MIT comes in, whose engineers have created a defense they say could tackle the problem to a large extent. The best, his way of explaining how that solution works.
DAWG and the cooks
Researchers at MIT CSAIL (Computer Science and Artificial Intelligence Laboratory) believe that they have discovered the way to solve a good part of the risk posed by Meltdown and Specter, and have called that solution DAWG (Dynamically Allocated Way Guard).
This technique is an alternative to the one used by Intel since 2016, called CAT (Cache Allocation Technology), and this is where MIT compared one to the other using an analogy that reminds us of culinary television programs.
For these developers, the Intel solution works with chefs in different sections (in memory) and everyone knows their own recipes and what ingredients they can use, but there may be leaks and a recipe is known outside of those sections.
To solve this problem, MIT plans to create walls that separate the different chefs, their ingredients and the recipes themselves, thereby avoiding communications that could lead to information thefts.
The chefs would be in this analogy what the MIT engineers call ‘protection domains’, which would be walled with a “safe partitioning” of the processors’ cache memory.
With DAWG, each application is completely isolated through the cache, thus avoiding data leaks and ensuring the channel that is currently used for those ‘cache timing attacks’ that take advantage of the Meltdown and Specter variants.
MIT engineers indicate how in their tests they demonstrated that DAWG and CAT have a similar performance, but the necessary modifications to implement this technique in modern systems are “minimal”.
They also warn: DAWG is not a definitive and complete solution, but it requires very little work to be applied in all types of systems and apparently has no impact on the performance of those systems. The engineers are trying to expand this work to make it even more effective, and it is certainly good news that there are independent efforts in this regard.