  Recent security vulnerabilities that target speculative execution (e.g.,
Spectre) present a significant challenge for processor design. The highly
publicized vulnerability uses speculative execution to learn victim secrets by
changing cache state. As a result, recent computer architecture research has
focused on invisible speculation mechanisms that attempt to block changes in
cache state due to speculative execution. Prior work has shown significant
success in preventing Spectre and other vulnerabilities at modest performance
costs. In this paper, we introduce speculative interference attacks, which show
that prior invisible speculation mechanisms do not fully block these
speculation-based attacks. We make two key observations. First, misspeculated
younger instructions can change the timing of older, bound-to-retire
instructions, including memory operations. Second, changing the timing of a
memory operation can change the order of that memory operation relative to
other memory operations, resulting in persistent changes to the cache state.
Using these observations, we demonstrate (among other attack variants) that
secret information accessed by mis-speculated instructions can change the order
of bound-to-retire loads. Load timing changes can therefore leave
secret-dependent changes in the cache, even in the presence of invisible
speculation mechanisms. We show that this problem is not easy to fix:
Speculative interference converts timing changes to persistent cache-state
changes, and timing is typically ignored by many cache-based defenses. We
develop a framework to understand the attack and demonstrate concrete
proof-of-concept attacks against invisible speculation mechanisms. We provide
security definitions sufficient to block speculative interference attacks;
describe a simple defense mechanism with a high performance cost; and discuss
how future research can improve its performance.
