2023/12/04 by Chaoqun Shen, Shen, Chaoqun, Gang Qu +3
Computer Science · Engineering · #Advanced Malware Detection Techniques #FOS: Computer and information sciences #Hardware Architecture (cs.AR) #Radiation Effects in Electronics #Security and Verification in Computing
paper · pdf · doi:10.48550/arxiv.2312.01832
openalex publication_date 2023/12/04 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Runahead execution is a continuously evolving microarchitectural technique for processor performance. This paper introduces the first transient execution attack on the runahead execution, called SPECRUN, which exploits the unresolved branch prediction during runahead execution. We show that SPECRUN eliminates the limitation on the number of transient instructions posed by the reorder buffer size, enhancing the exploitability and harmfulness of the attack. We concretely demonstrate a proof-of-concept attack that causes leaking secrets from a victim process, validate the merit of SPECRUN, and design a secure runahead execution scheme. This paper highlights the need to consider the security of potential optimization techniques before implementing them in a processor.