Analyzing Cache Timing-based Side Channel Vulnerability Through Cache Line Composition

Microarchitectural side-channel attacks (SCAs) have gained increasing attention in the security community and cache timing is one of the most popular microarchitectural side-channels. However, most researches have focused on proposing novel cache attacks and defenses and there is limited work in understanding and analyzing the vulnerabilities of cache itself. This paper proposes a novel three-step model to analyze cache timing-based side channel vulnerabilities. In our model, the states and state transition relationships of cache lines are modeled through valid bits, dirty bits and replacement control bits in cache line composition. Our model distinguishes the different impacts of read access and write access through dirty bits, further considering the observable timing differences caused by write-back strategies. The model comprehensively covers cache timing-based attack surface and derive all possible exploitable cache timing-based vulnerabilities. As a result, we have derived in total 336 exploitable cache vulnerabilities, of which 248 are new.