Side-Channel Attack, Spectre, Meltdown — যখন CPU নিজেই গোপন কথা ফাঁস করে

লক্ষ্য: আগের দুইটা Experiment আলাদা করে দেখিয়েছে টাইমিং সিগন্যাল আর cache covert channel কীভাবে কাজ করে। এখানে সেই একই cache-channel-কে speculative execution-এর দুইটা ভিন্ন ট্রিগার-এর সাথে জুড়ে দেখানো হবে — একটাতে একটা permission check বাইপাস হয় (Meltdown), আরেকটাতে একটা bounds check বাইপাস হয় predictor-কে ভুল শিখিয়ে (Spectre)।

# meltdown_spectre_sim.py -- simplified simulations of the Meltdown and Spectre
# mechanisms, built on the same SimulatedCache / Flush+Reload primitives as the
# earlier cache_covert_channel.py. Nothing here measures a real CPU -- it models
# the two mechanisms directly: (1) speculative execution touches the cache BEFORE
# a check resolves, and (2) the CPU's rollback restores ARCHITECTURAL state
# (registers, memory, return values) but never restores MICROARCHITECTURAL state
# (which cache lines are hot) -- so the side channel survives the rollback.

CACHE_HIT_CYCLES = 4
CACHE_MISS_CYCLES = 200
NUM_LINES = 256

class SimulatedCache:
    def __init__(self):
        self.cached = set()

    def flush_all(self):
        self.cached.clear()

    def access(self, line: int) -> int:
        hit = line in self.cached
        self.cached.add(line)
        return CACHE_HIT_CYCLES if hit else CACHE_MISS_CYCLES

def attacker_recover_byte(cache, probe_base):
    """FLUSH+RELOAD (Yarom & Falkner, 2014) -- identical to cache_covert_channel.py."""
    timings = {c: cache.access(probe_base + c) for c in range(NUM_LINES)}
    return min(timings, key=timings.get)

# =====================================================================
# PART 1 -- Meltdown: speculative read PAST A PERMISSION CHECK
# =====================================================================
print("=" * 70)
print("PART 1: Meltdown -- permission check bypassed by speculation")
print("=" * 70)

KERNEL_SECRET = b"root"   # stand-in for privileged kernel memory a user process cannot read

class MeltdownCPU:
    def __init__(self):
        self.cache = SimulatedCache()

    def speculative_read_and_leak(self, is_privileged: bool, secret_byte: int, probe_base: int):
        """Models: `if (check_permission(addr)) { v = *addr; probe[v * 4096]; }`
        On real hardware, the out-of-order engine does not WAIT for
        check_permission() to resolve before issuing the dependent load and the
        array-index -- it runs them speculatively first, using whatever byte
        sits at `addr`, regardless of whether the permission check will pass."""
        # (1) speculative execution happens FIRST and unconditionally --
        #     this line runs before the permission check below is evaluated
        self.cache.access(probe_base + secret_byte)

        # (2) only afterward does the permission check "catch up" -- on a
        #     real CPU this fires a fault, the pipeline is flushed, and the
        #     ARCHITECTURAL result (the register that would have held the
        #     byte) is discarded. The program never sees the value.
        if is_privileged:
            raise PermissionError("privileged memory -- architectural read blocked")
        return secret_byte   # normal, legitimate case: no exception, real value returned

cpu = MeltdownCPU()
print(f"real KERNEL_SECRET (attacker cannot read this legitimately) = {KERNEL_SECRET!r}\n")

recovered = bytearray()
architectural_successes = 0
for i, true_byte in enumerate(KERNEL_SECRET):
    cpu.cache.flush_all()
    try:
        value = cpu.speculative_read_and_leak(is_privileged=True, secret_byte=true_byte, probe_base=0)
        architectural_successes += 1
        print(f"byte {i}: architectural read SUCCEEDED (should never happen!) -> {value}")
    except PermissionError:
        pass   # exactly as expected -- the direct read is always blocked
    got = attacker_recover_byte(cpu.cache, 0)
    recovered.append(got)
    print(f"byte {i}: true={true_byte:#04x} ({chr(true_byte)!r})  "
          f"leaked-via-cache={got:#04x} ({chr(got)!r})  match={got == true_byte}")

print(f"\narchitectural reads that ever succeeded: {architectural_successes} (must be 0)")
print(f"recovered kernel secret (cache side-channel only) = {bytes(recovered)!r}")
print(f"fully recovered despite every direct read being blocked? {bytes(recovered) == KERNEL_SECRET}")

# =====================================================================
# PART 2 -- Spectre: mistrained branch predictor bypasses a BOUNDS check
# =====================================================================
print()
print("=" * 70)
print("PART 2: Spectre -- bounds check bypassed by a mistrained predictor")
print("=" * 70)

# Same 2-bit saturating counter from computer-architecture/branch-prediction.mdx,
# repurposed here to predict the OUTCOME OF A BOUNDS CHECK instead of a branch:
# state >= 2 means "predict in-bounds" (speculatively run the array access).
class TwoBitPredictor:
    def __init__(self):
        self.state = 3   # start Strongly-predict-in-bounds

    def predicts_in_bounds(self) -> bool:
        return self.state >= 2

    def update(self, actually_in_bounds: bool):
        self.state = min(3, self.state + 1) if actually_in_bounds else max(0, self.state - 1)

ARRAY1 = bytes([10, 20, 30, 40, 50])   # the public, bounds-checked array; length 5
SECRET_DATA = b"pwd!"                   # lives immediately after ARRAY1 in memory
MEMORY = ARRAY1 + SECRET_DATA           # attacker's OOB index reaches straight into it
ARRAY1_SIZE = len(ARRAY1)

def victim_function(cache, predictor, x, probe_base):
    """Models: `if (x < array1_size) { y = array1[x]; probe[y * 4096]; }`
    The bounds check `x < array1_size` is itself a branch -- and branches get
    predicted, exactly like the ones in branch-prediction.mdx. A predictor
    mistrained to expect 'in bounds' lets speculative execution run the body
    (the array read + cache-touching probe access) BEFORE the real check
    resolves -- even for an `x` that is architecturally out of bounds."""
    if predictor.predicts_in_bounds():
        # speculative body: runs immediately on the PREDICTION, not the fact
        if x < len(MEMORY):          # (speculation still needs a backing address;
            value = MEMORY[x]        #  real Spectre PoCs rely on this being true
            cache.access(probe_base + value)   # for adjacent secret data)

    real_in_bounds = x < ARRAY1_SIZE
    predictor.update(real_in_bounds)
    if not real_in_bounds:
        raise IndexError("array1 index out of range (blocked architecturally)")
    return MEMORY[x]

cache = SimulatedCache()
predictor = TwoBitPredictor()

print(f"real SECRET_DATA (lives just past ARRAY1 in memory, attacker cannot read it directly) = {SECRET_DATA!r}\n")

print("--- training phase: many in-bounds calls, exactly like a normal, honest use of the API ---")
for i in range(20):
    x = i % ARRAY1_SIZE
    victim_function(cache, predictor, x, probe_base=0)
print(f"predictor state after training = {predictor.state} (>=2 means 'predict in-bounds')")

print("\n--- attack phase: re-train right before each OOB call (real Spectre PoCs do exactly this,")
print("    since each successful misprediction nudges the counter back toward 'in-bounds') ---")
recovered_spectre = bytearray()
architectural_successes = 0
for i in range(len(SECRET_DATA)):
    for _ in range(5):   # short re-training burst, purely in-bounds, keeps predictor confident
        victim_function(cache, predictor, i % ARRAY1_SIZE, probe_base=0)
    x = ARRAY1_SIZE + i   # architecturally out of bounds -- reaches into SECRET_DATA
    cache.flush_all()
    try:
        value = victim_function(cache, predictor, x, probe_base=0)
        architectural_successes += 1
        print(f"byte {i}: architectural read SUCCEEDED (should never happen!) -> {value}")
    except IndexError:
        pass   # exactly as expected -- the real bounds check always eventually fires
    got = attacker_recover_byte(cache, 0)
    recovered_spectre.append(got)
    true_byte = SECRET_DATA[i]
    print(f"byte {i}: true={true_byte:#04x} ({chr(true_byte)!r})  "
          f"leaked-via-cache={got:#04x} ({chr(got)!r})  match={got == true_byte}  "
          f"predictor state after this call={predictor.state}")

print(f"\narchitectural reads that ever succeeded: {architectural_successes} (must be 0)")
print(f"recovered secret (cache side-channel only) = {bytes(recovered_spectre)!r}")
print(f"fully recovered despite every bounds check firing? {bytes(recovered_spectre) == SECRET_DATA}")

প্রকৃত চালিয়ে পাওয়া output (deterministic — হুবহু এটাই আসবে):

======================================================================
PART 1: Meltdown -- permission check bypassed by speculation
======================================================================
real KERNEL_SECRET (attacker cannot read this legitimately) = b'root'

byte 0: true=0x72 ('r')  leaked-via-cache=0x72 ('r')  match=True
byte 1: true=0x6f ('o')  leaked-via-cache=0x6f ('o')  match=True
byte 2: true=0x6f ('o')  leaked-via-cache=0x6f ('o')  match=True
byte 3: true=0x74 ('t')  leaked-via-cache=0x74 ('t')  match=True

architectural reads that ever succeeded: 0 (must be 0)
recovered kernel secret (cache side-channel only) = b'root'
fully recovered despite every direct read being blocked? True

======================================================================
PART 2: Spectre -- bounds check bypassed by a mistrained predictor
======================================================================
real SECRET_DATA (lives just past ARRAY1 in memory, attacker cannot read it directly) = b'pwd!'

--- training phase: many in-bounds calls, exactly like a normal, honest use of the API ---
predictor state after training = 3 (>=2 means 'predict in-bounds')

--- attack phase: re-train right before each OOB call (real Spectre PoCs do exactly this,
    since each successful misprediction nudges the counter back toward 'in-bounds') ---
byte 0: true=0x70 ('p')  leaked-via-cache=0x70 ('p')  match=True  predictor state after this call=2
byte 1: true=0x77 ('w')  leaked-via-cache=0x77 ('w')  match=True  predictor state after this call=2
byte 2: true=0x64 ('d')  leaked-via-cache=0x64 ('d')  match=True  predictor state after this call=2
byte 3: true=0x21 ('!')  leaked-via-cache=0x21 ('!')  match=True  predictor state after this call=2

architectural reads that ever succeeded: 0 (must be 0)
recovered secret (cache side-channel only) = b'pwd!'
fully recovered despite every bounds check firing? True

দুইটা অংশেই architectural reads that ever succeeded: 0 — এই লাইনটাই সবচেয়ে গুরুত্বপূর্ণ। প্রতিবার সরাসরি read চেষ্টা করলেই exception উঠেছে (PermissionError Meltdown-এ, IndexError Spectre-এ) — ঠিক যেমনটা একটা সঠিকভাবে-লেখা, memory-safe প্রোগ্রামে হওয়ার কথা। তবু fully recovered ... True — কারণ leak কখনো architectural read-এর মধ্য দিয়ে ঘটেইনি, ঘটেছে speculative execution-এর রেখে যাওয়া cache-fingerprint-এর মধ্য দিয়ে, যেটা exception ওঠার আগেই স্থায়ী হয়ে গিয়েছিল। PART 1 আর PART 2-এর মধ্যে পার্থক্যটা লক্ষ্য করুন — Meltdown-এ speculation ট্রিগার হয়েছে একটা permission check-এর বিপরীতে (privilege boundary, user বনাম kernel), Spectre-এ ট্রিগার হয়েছে একটা bounds check-এর বিপরীতে, predictor-কে বারবার in-bounds call দিয়ে “প্রশিক্ষণ” দিয়ে (logical boundary, array-এর ঘোষিত সীমা)। এই একটা পার্থক্যই realworld সেকশনে দেখা যাবে কেন দুইটার mitigation সম্পূর্ণ আলাদা রাস্তায় গেছে।

নিজে বাড়ান:

1. Meltdown অংশে is_privileged=False দিয়ে চালিয়ে দেখুন — architectural read কেন এবার সফল হয়, আর architectural_successes সংখ্যাটা কীভাবে বদলায়
2. Spectre অংশে training burst সংখ্যা (5) কমিয়ে 1 করুন — কয়টা attack byte-এ predictor আসলে “মিসপ্রেডিক্ট থেকে বেরিয়ে” যায় (state < 2-এ নেমে যায়) আর সেই byte-এর leak ব্যর্থ হয় দেখুন; এটাই বাস্তব Spectre PoC-তে training-burst-সাইজ একটা tunable প্যারামিটার কেন
3. victim_function-এ if x < len(MEMORY) শর্তটা সরিয়ে ফেলুন এবং ব্যাখ্যা করুন কেন বাস্তব হার্ডওয়্যারে speculation-এরও একটা সীমা আছে (out-of-bounds access করলেও সেটা কোনো mapped page-এর মধ্যেই হতে হয়, নাহলে speculative execution নিজেই একটা page fault-এ থেমে যায় — Spectre PoC-গুলো তাই সবসময় “কাছাকাছি,” mapped memory-ই টার্গেট করে)