Paper 2022/1394

Risky Translations: Securing TLBs against Timing Side Channels

Florian Stolz, Ruhr University Bochum
Jan Philipp Thoma, Ruhr University Bochum
Pascal Sasdrich, Ruhr University Bochum
Tim Güneysu, Ruhr University Bochum

Microarchitectural side-channel vulnerabilities in modern processors are known to be a powerful attack vector that can be utilized to bypass common security boundaries like memory isolation. As shown by recent variants of transient execution attacks related to Spectre and Meltdown, those side channels allow to leak data from the microarchitecture to the observable architectural state. The vast majority of attacks currently build on the cache-timing side channel, since it is easy to exploit and provides a reliable, fine-grained communication channel. Therefore, many proposals for side-channel secure cache architectures have been made. However, caches are not the only source of side-channel leakage in modern processors and mitigating the cache side channel will inevitably lead to attacks exploiting other side channels. In this work, we focus on defeating side-channel attacks based on page translations. It has been shown that the Translation Lookaside Buffer ( TLB) can be exploited in a very similar fashion to caches. Since the main caches and the TLB share many features in their architectural design, the question arises whether existing countermeasures against cache-timing attacks can be used to secure the TLB. We analyze state-of-the-art proposals for side-channel secure cache architectures and investigate their applicability to TLB side channels. We find that those cache countermeasures are not directly applicable to TLB s, and propose TLBcoat, a new side-channel secure TLB architecture. We provide evidence of TLB side-channel leakage on RISC-V-based Linux systems, and demonstrate that TLBcoat prevents this leakage. We implement TLBcoat using the gem5 simulator and evaluate its performance using the PARSEC benchmark suite.

Available format(s)
Publication info
Published by the IACR in TCHES 2023
Microarchitecture Side Channel TLB
Contact author(s)
florian stolz @ rub de
jan thoma @ rub de
pascal sasdrich @ rub de
tim gueneysu @ rub de
2022-10-14: approved
2022-10-14: received
See all versions
Short URL
Creative Commons Attribution


      author = {Florian Stolz and Jan Philipp Thoma and Pascal Sasdrich and Tim Güneysu},
      title = {Risky Translations: Securing {TLBs} against Timing Side Channels},
      howpublished = {Cryptology ePrint Archive, Paper 2022/1394},
      year = {2022},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.