MELTWEB: A Transient Execution Attack to Capture Data in Fill Line Buffer

Abstract

The out-of-order execution mechanism is widely used in modern processors. However, meltdown attacks exploit this mechanism to allow malicious instructions to capture sensitive data from kernel domains. This work aims to present a new meltdown attack, called Meltweb. It is a new approach in the category of privileged speculative execution attacks to leak arbitrary data into address spaces and privilege limits. Meltweb can be implemented from linear execution without the need for page faults, eliminating the need for an exception suppression mechanism, thus allowing the attack to be executed throughout the system of arbitrary code without privileges as in search engines interpretation of Javascript. To exemplify the performance of the attack, two proof-of-concept variants were developed that demonstrate the ability to perform the attack natively, as well as remotely using Javascript. The attack developed showed satisfactory results in its two variants, with 98% accuracy in capturing confidential data in the native variant. For the remote variant, the attack proved to be capable of capturing navigation data as a URL recovery with an error rate of 2.3%.