https://github.com/Eugnis/spectre-attack
Example of using revealed "Spectre" exploit (CVE-2017-5753 and CVE-2017-5715)
https://github.com/Eugnis/spectre-attack
c example exploit security-vulnerability spectre
Last synced: 1 day ago
JSON representation
Example of using revealed "Spectre" exploit (CVE-2017-5753 and CVE-2017-5715)
- Host: GitHub
- URL: https://github.com/Eugnis/spectre-attack
- Owner: Eugnis
- Created: 2018-01-04T00:28:50.000Z (over 7 years ago)
- Default Branch: master
- Last Pushed: 2018-01-10T01:14:44.000Z (over 7 years ago)
- Last Synced: 2024-11-09T16:43:26.244Z (5 months ago)
- Topics: c, example, exploit, security-vulnerability, spectre
- Language: C
- Size: 22.5 KB
- Stars: 757
- Watchers: 41
- Forks: 171
- Open Issues: 7
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Spectre Attack Example
Example of using revealed "Spectre" exploit from 2 Jan 2018 (CVE-2017-5753 and CVE-2017-5715)
Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.
* [Spectre paper] - Spectre paper and source of code
## Language
C, uses libs:
* stdio.h
* stdint.h
* intrin.h - for rdtscp and clflush
## What's example do?
We're putting text "The Magic Words are Squeamish Ossifrage." in memory and then we're trying to read it using exploit. If system is vulnerable, you'll see same text in output, read from memory.
***
In this code, if the compiled instructions in `victim_function()` were executed in strict program order, the function would only read from `array1[0..15]` since array1 size = 16. However, when executed speculatively, out-of-bounds reads are possible. The `readMemoryByte()` function makes several training calls to `victim_function()` to make the branch predictor expect valid values for x, then calls with an out-of-bounds x. The conditional branch mispredicts, and the ensuing speculative execution reads a secret byte using the out-of-bounds x. The speculative code then reads from `array2[array1[x] * 512]`, leaking the value of `array1[x]` into the cache state. To complete the attack, a simple flush+probe is used to identify which cache line in `array2` was loaded, revealing the memory contents. The attack is repeated several times, so even if the target byte was initially uncached, the first iteration will bring it into the cache.
The unoptimized code reads approximately 10KB/second on an i7 Surface Pro 3.
## Building
### Using GCC
`gcc -std=c99 Source.c -o spectre.out`
or
`make`
### Using Visual Studio
Create new empty project and add Source.c then click on Build.
## Executing
### Test
`.\spectre.out` with no params.
### Read from address
`.\spectre.out {address} {length}` with params:
* address - pointer address of victim char *
* length - length of char *
## Sources
* [Spectre exploits info]
* [CVE-2017-5753] - Variant 1: bounds check bypass
* [CVE-2017-5715] - Variant 2: branch target injection
* [Intel affected CPUs list]
[Spectre paper]:
[Spectre exploits info]:
[CVE-2017-5753]:
[CVE-2017-5715]:
[Intel affected CPUs list]: