A Fetching Tale: Covert Communication with the Hardware Prefetcher

Abstract

Modern processors have employed various methods to increase performance, such as speculative execution, branch prediction, and prefetching. While these enhancements provide excellent performance benefits, many of them also leak confidential information via side channels or can be utilized to communicate surreptitiously via a covert channel. This paper presents a new covert channel within the modern Intel processor, found in the oft-overlooked hardware prefetcher. The discovered covert channel allows two processes scheduled on the same core to communicate without any need to access data that should be mapped to the same cache set. Experimental results on Intel Core i7-6700 show that the channel is able to achieve a 41.6 KBps transmission speed with low error rates. It is also shown that the state-of-the-art side channel and covert channel detection schemes have little impact on this prefetcher-based covert channel.