Nested Speculative Execution Attacks via Runahead

Runahead execution is an effective microarchitectural level performance boosting technique. It removes the blocking load instruction with long latency and speculatively executes the subsequent instructions with little pipeline modifications. However, the nature of prefetching data and instructions creates potential security risks similar to Spectre and Meltdown. In this work, we present the first comprehensive analysis of the security implications of runahead execution and report a novel attack, named SPECRUN. SPECRUN exploits the unresolved branch predictions within nested speculative execution during runahead execution. It can manipulate the speculative execution window and hence eliminates the major limitation of Spectre-type attacks: the number of executable transient instructions is limited by the small reorder buffer size. Therefore, SPECRUN can improve the exploitability of transient attacks significantly. To demonstrate this, we implement a proof-of-concept attack that can successfully extract secrets from a victim process. We analyze existing defense techniques and propose new ones against SPECRUN. The effectiveness and overhead of these mitigation mechanisms are carefully discussed to shed light on the security vulnerabilities and defense before the adoption of runahead execution on current and future processors.