Spectre — Speculative Execution Vulnerability

Spectre is a class of microarchitectural side-channel attacks that exploit speculative execution in modern CPUs to leak sensitive data across security boundaries.

Overview

Discovered independently by Jann Horn of Google Project Zero and researchers from several universities, Spectre affects virtually all modern processors that implement speculative execution — including Intel, AMD, ARM, and IBM chips.

Unlike traditional software vulnerabilities, Spectre stems from fundamental hardware design optimizations. It forces the CPU to speculatively execute instructions that should never run, leaving measurable side effects in cache state that can be probed by an attacker.

Two Variants

Variant 1 — Bounds Check Bypass (CVE-2017-5753)

Exploits conditional branch misprediction. The attacker trains the branch predictor to speculatively execute code with an out-of-bounds index, causing the CPU to transiently read memory it should not access.

Key insight: The CPU performs the memory access speculatively before verifying the bounds check. Even though the result is eventually discarded, the access pattern leaves traces in the cache that can be measured.

Variant 2 — Branch Target Injection (CVE-2017-5715)

Manipulates the branch target buffer (BTB) to redirect speculative execution to attacker-chosen locations. This allows indirect branches to be hijacked during speculative execution, potentially exposing arbitrary kernel memory to user-space processes.

Attack Mechanism

The attack follows three conceptual phases:

Setup phase — Train the branch predictor with a pattern that causes misprediction
Trigger phase — Force speculative execution of the gadget with attacker-controlled input
Recovery phase — Use cache timing (e.g., Flush+Reload) to infer leaked bits

Mitigations

Complete elimination of Spectre requires hardware changes. Software mitigations include:

LFENCE insertion to block speculative execution past bounds checks
Retpoline (return trampoline) for indirect branch isolation
Site Isolation in browsers to separate origins into different processes
Microcode updates enabling Indirect Branch Restricted Speculation (IBRS)

Note: Mitigations often carry performance penalties ranging from negligible to 30% depending on workload, particularly for system calls and indirect branch-heavy code.

Impact

Spectre can potentially read arbitrary memory in the victim's address space — including passwords, encryption keys, and other secrets — without leaving traces in traditional logs. The attack is difficult to detect and can be executed from JavaScript in a web browser.

References

Kocher et al. — "Spectre Attacks: Exploiting Speculative Execution", IEEE S&P 2019
Google Project Zero — Reading privileged memory with a side-channel
Intel Security Advisory INTEL-SA-00088