Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

Spectre-class side-channel → cross-tenant memory leak

Pre-mitigation cloud VM lets a co-tenant trigger speculative loads from kernel / sibling-VM memory. Cache-side-channel measurements recover sensitive data, including TLS keys + cloud creds.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: shared-host cloud VM / serverless / container runtime not patched / not configured for Spectre mitigations (KPTI, IBRS, retpolines, MDS). Attacker can run their own code in the same hardware context.

§ Steps

  1. 01
    Spin up co-resident VM / lambdaInitial Access
    T1078— Valid Accounts
  2. 02
    Reconstruct kernel / neighbour memoryCredential Access
    T1003— OS Credential Dumping
  3. 03
    Exfil leaked TLS keys / IAM credsCredential Access
    T1552— Unsecured Credentials
  4. 04
    Drive speculative loads from target contextCredential Access
    HW-SPECTRE— Spectre / Meltdown-class Side-Channel
  5. 05
    FLUSH+RELOAD cache probingCredential Access
    HW-CACHE-TIMING— Cache Timing Attack (FLUSH+RELOAD / PRIME+PROBE)
  6. 06
    Confirm vulnerable microcodeCredential Access
    HW-CACHE-TIMING— Cache Timing Attack (FLUSH+RELOAD / PRIME+PROBE)

§ References

§ Frequently asked

What is the "Spectre-class side-channel → cross-tenant memory leak" attack path?
Pre-mitigation cloud VM lets a co-tenant trigger speculative loads from kernel / sibling-VM memory. Cache-side-channel measurements recover sensitive data, including TLS keys + cloud creds. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Spin up co-resident VM / lambda (T1078) — a initial access primitive. Assumed environment: shared-host cloud VM / serverless / container runtime not patched / not configured for Spectre mitigations (KPTI, IBRS, retpolines, MDS).
What is the final impact of this kill-chain?
The final step lands on Confirm vulnerable microcode (HW-CACHE-TIMING), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers