New Technical Analysis: Understanding Microarchitectural Attacks

We are pleased to share the publication of Microarchitectural attacks: concepts and analysis, a new technical reference for engineers who design, integrate, or secure embedded systems.

Complementing our Security Technical Implementation Guides (STIGs), this document explains how processor implementation details can undermine the isolation promised by the architectural model. It connects the underlying mechanisms to published attack families, their prerequisites, and the countermeasures available at the hardware, operating system, compiler, and application levels.

The document supports risk analysis, architecture review, and product vulnerability response. It is not an exploitation procedure and does not provide ready-to-use attack code.

Technical Scope

The analysis covers the mechanisms and security boundaries involved in several major attack families:

• speculative and out-of-order execution, caches, branch predictors, and internal buffers
• Spectre variants, Meltdown, Foreshadow/L1TF, microarchitectural data sampling, and value injection
• Rowhammer and DRAM disturbances, distinguishing memory corruption from information leakage
• CLKSCREW and faults induced through power management, alongside timing channels outside transient execution

For embedded products, the analysis also considers heterogeneous SoCs, RTOSes, hypervisors, TEEs, DMA and accelerators, real-time constraints, and long operational lifetimes.

Analysis Objectives

The document aims to:

• explain why cancelling an instruction does not necessarily erase its observable microarchitectural effects
• distinguish attack prerequisites, information leaks, and the conditions needed for a broader compromise
• identify the physical cores, silicon revisions, shared resources, and trust boundaries relevant to a product
• assess defence-in-depth measures across silicon and microcode, firmware and system software, compilers and applications, and memory
• provide a product qualification procedure and design review questions, including the evolution and limits of mitigations

An attack name alone is not enough to determine exposure. Applicability depends on the actual processor implementation, revision, software configuration, and attacker access conditions. The guide therefore encourages teams to verify vendor guidance and the mitigations enabled on their own platform, rather than assuming that every processor in a family shares the same vulnerabilities.

Download the Analysis

English version: Download Technical Analysis (PDF)

French version: Télécharger l’analyse technique (PDF)

The document is published under the Creative Commons BY-NC-ND 4.0 license.