Search

Journal of materiomics 8(6), 1095-1103 (2022). doi:10.1016/j.jmat.2022.07.005, Published by Elsevier, Amsterdam [u.a.]

The transient execution attack is a type of attack leveraging the vulnerability of modern CPU optimization technologies. New attacks surface rapidly. The side-channel is a key part of transient execution attacks to leak data. In this work, we discover a vulnerability that the change of the EFLAGS register in transient execution may have a side effect on the Jcc (jump on condition code) instruction after it in Intel CPUs. Based on our discovery, we propose a new side-channel attack that leverages the timing of both transient execution and Jcc instructions to deliver data. This attack encodes secret data to the change of register which makes the execution time of context slightly slower, which can be measured by the attacker to decode data. This attack doesn't rely on the cache system and doesn't need to reset the EFLAGS register manually to its initial state before the attack, which may make it more difficult to detect or mitigate. We implemented this side-channel on machines with Intel Core i7-6700, i7-7700, and i9-10980XE CPUs. In the first two processors, we combined it as the side-channel of the Meltdown attack, which could achieve 100\% success leaking rate. We evaluate and discuss potential defenses against the attack. Our contributions include discovering security vulnerabilities in the implementation of Jcc instructions and EFLAGS register and proposing a new side-channel attack that does not rely on the cache system.

Performance Monitoring Unit (PMU) is a common hardware module in Intel CPUs. It can be used to record various CPU behaviors therefore it is often used for performance analysis and optimization. Of the 65536 event spaces, Intel has officially published only 200 or so. In this paper, we design a hidden PMU event collection method. And we found a large number of undocumented PMU events in CPUs of Skylake, Kabylake, and Alderlake microarchitectures. We further demonstrate the existence of these events by using them for transient execution attack detection and build-side channel attacks. This also implies that these hidden PMU events have huge exploitation potential and security threats.

Additional file 3: Figure S3. Analysis of DFS associated with TMB.

Additional file 1: Fig. S1. Kaplan-Meier plot for DFS in patients treated with neoadjuvant immunotherapy.

Bacterial wilt caused by Ralstonia solanacearum is a distributed and worldwide soilborne disease. The application of biocontrol microbes or agricultural chemicals has been widely used to manage tomato bacterial wilt. However, whether and how agricultural chemicals affect the antagonistic ability of biocontrol microbes is still unknown. Here, we combined potassium phosphite (K-Phite), an environmentally friendly agricultural chemical, and the biocontrol agent Bacillus amyloliquefaciens QPF8 (strain F8) to manage tomato bacterial wilt disease. First, K-Phite at a concentration of 0.05% (wt/vol) could significantly inhibit the growth of R. solanacearum. Second, 0.05% K-Phite enhanced the antagonistic capability of B. amyloliquefaciens F8. Third, the greenhouse soil experiments showed that the control efficiency for tomato bacterial wilt in the combined treatment was significantly higher than that of the application of B. amyloliquefaciens F8 or K-Phite alone. Overall, our results highlighted a novel strategy for the control of tomato bacterial wilt disease via application and revealed a new integrated pattern depending on the enhancement of the antagonistic capability of biocontrol microbes by K-Phite.

Performance Monitor Unit (PMU) is a significant hardware module on the current processors, which counts the events launched by processor into a set of PMU counters. Ideally, the events triggered by instructions that are executed but the results are not successfully committed (transient execution) should not be recorded. However, in this study, we discover that some PMU events triggered by the transient execution instructions will actually be recorded by PMU. Based on this, we propose the PMUSpill attack, which enables attackers to maliciously leak the secret data that are loaded during transient executions. The biggest challenge is how to encode the secret data into PMU events. We construct an instruction gadget to solve this challenge, whose execution path that can be identified by PMU counters represents what values the secret data are. We successfully implement the PMUSpill attack to leak the secret data stored in Intel Software Guard Extensions (SGX) (a Trusted Execution Environment (TEE) in the Intel's processors) through real experiments. Besides, we locate the vulnerable PMU counters and their trigger instructions by iterating all the valid PMU counters and instructions. The experiment results demonstrate that there are up to 20 PMU counters available to implement the PMUSpill attack. We also provide some possible hardware and software-based countermeasures for addressing the PMUSpill attack, which can be utilized to enhance the security of processors in future.

High-throughput sequencing, culture-dependent workflows, and microbiome transfer experiments reveal whether potassium phosphite (KP), an environmentally acceptable agricultural chemical, could specifically enrich the antagonistic bacterial community that inhibited the growth of the pathogen Ralstonia solanacearum. The application of KP enriched the potential antagonistic bacteria Paenibacillus and Streptomyces in soil, but depleted most dominant genera belonging to gram negative bacteria, such as Pseudomonas, Massilia, and Flavobacterium on day 7. Moreover, the KP-modulated soil microbiome suppressed R. solanacearum growth in soil. The predicted functions related to the synthesis of antagonistic substances, such as streptomycin, and the predicted functions related to tellurite resistance and nickel transport system were significantly enriched, but the synthesis of lipopolysaccharide (distinct component lipopolysaccharide in gram negative bacteria) were significantly depleted in the KP-treated soils. In addition, the copy numbers of specific sequences for Streptomyces coelicoflavus and Paenibacillus favisporus were significantly increased in the soil amended with KP, inhibited the growth of R. solanacearum, and had a higher tolerance of KP than R. solanacearum. Our study linked the application of fertilizers to the enrichment of antagonistic bacteria, which could support future work that aims to precisely regulate the soil microbiome to protect the host from infection by soil-borne pathogens.

The Instruction Level Parallelism(ILP) of VLIW DSP processor is acquired through operation partitioning and software pipeline.In the previous research of operation partitioning,people always focus on reducing move operations between clusters,but rarely consider the effect of heterogeneous architecture and some registers that should be placed on reserved cluster.A method based on DataFlow Graph(DFG) for heterogeneous architecture was described to solve this problem.First,the DFG was partitioned into several sub-graphs according to the relations between operations,then the sub-graphs were refined with a heuristic method to meet the requirements of special registers.The experimental results show that this method can make the load of cluster more balanced,and achieve an average of 8% improvement over traditional method.