Abstract:Modern processor optimizations including out-of-order execution and speculative mechanism are critical for performance. Recent research such as Meltdown and Spectre exploit delayed exception handling and misprediction events to trigger transient execution, and leak otherwise inaccessible information via the CPU's microarchitectural state from instructions which are never committed. This type of attacks is called transient execution attack, which is different from the traditional cache side channel attack. It is more difficult to mitigate. This work deeply studied the mechanism and implementation of transient execution attacks, and summarized its research status and defenses. First, the optimizations adopted by the processor are introduced, and the essential causes of the transient execution attack are analyzed. Then, the transient execution attacks are generalized systematically based on the primitives that trigger the transient execution, in order to reveal the attack surface. Finally, the defenses are summarized in the view of the key steps and components in the attack model, and the future research directions of this field are presented.