search

HexHive / SMoTherSpectre

Proof-of-concept code for the SMoTherSpectre exploit.
73 stars 16 forks source link

Accuracy is around 0.5 in newer generation CPUs #3

Closed moep0 closed 1 year ago

moep0 commented 1 year ago

Accuracy is around 0.5 in newer generation CPUs, i5-8265u and i7-10700 (ubuntu 18.04, one kernel is 5.15.0-58-genric and the other is around 5.xx.x).

I run the steps as mentioned in another issue and the readme file. I also use the command "sudo apt remove inel-microcode" to disable the latest microcode.

But the accuracy is still around 0.5. The output file victim_pmc0.csv is all zeros.

Is there any running error in my test?

I know it's been a long time since the paper was published, so I'd appreciate it if you could reply.

atrib commented 1 year ago

Cross-process BTI (branch-target injection) has been mitigated in Intel CPUs going back as far as the 8-th gen cores. While port-contention still likely exists, these cores prevent one hyperthread from affecting the speculative branch target for the other hyperthread. Same-process BTI across hyperthreads was still possible on the i7-8700, but not on later CPUs.

We show these results in another paper (SpecROP: Speculative Exploitation of ROP Chains, Table 1).