SSMR: Statically Detecting Speculation Safe Memory Regions to Mitigate Transient Execution Attacks

Transient execution attacks exploit speculative execution to leak confidential data through unauthorized transient memory accesses. We make the observation that transient attacks can be identified by one unusual memory access, the transient sensitive data access. To protect systems from such attacks while minimizing performance overhead, we propose leveraging compile-time information to identify memory operations that cannot extract sensitive data and can therefore be deemed safe. Safe memory operations are allowed to execute transiently, causing no extra performance cost. Unsafe memory operations delay accessing the memory system until they are no longer in a speculative state, preventing unauthorized transient accesses to sensitive data. To communicate this information to the microarchitecture, we introduce the set safe memory region (ssmr) instruction. Inserted automatically by the compiler, it establishes the memory regions that may be accessed transiently by a sequence of instructions. This defense incurs only a 7% performance overhead compared to the insecure baseline and mitigates at least two variants of transient execution attacks.