Exploit for Observable Discrepancy in Intel Atom_C CVE-2017-5715

## https://sploitus.com/exploit?id=D80DD255-E7C2-55A3-B3A8-E433EEE2722C
# 🛡️ Spectre Variant 2 (CVE-2017-5715) — Hardware Vulnerability Research


  
  
  
  



  An in-depth research paper and hands-on Proof-of-Concept (PoC) exploring speculative execution attacks on modern CPUs.


---

## 📖 Overview

This project is a research and lab-based exploration of **Spectre Variant 2 (CVE-2017-5715)**, also known as **Branch Target Injection** — a hardware-level side-channel vulnerability affecting CPUs that implement speculative execution and branch prediction.

The goal of this project was to:
- Understand the **microarchitectural root cause** of Spectre Variant 2
- Reproduce a working **Proof of Concept (PoC)** in an isolated virtual lab
- Analyze and validate the leaked data through **cache timing side-channel analysis**
- Document real-world **mitigation strategies**

> ⚠️ **Disclaimer:** This work was conducted strictly in a controlled, isolated virtual machine for academic and educational purposes. It does not target or affect any production system, and no proprietary exploit code was authored — the publicly available [SpectrePoC](https://github.com/crozone/SpectrePoC) repository was used for demonstration.

---

## 📑 Table of Contents

- [What is Spectre Variant 2?](#-what-is-spectre-variant-2)
- [How the Attack Works](#-how-the-attack-works)
- [Lab Environment](#-lab-environment)
- [Proof of Concept Walkthrough](#-proof-of-concept-walkthrough)
- [Demo Video](#-demo-video)
- [Mitigation Strategies](#-mitigation-strategies)
- [Repository Structure](#-repository-structure)
- [References](#-references)
- [Author](#-author)

---

## 🔍 What is Spectre Variant 2?

**CVE-2017-5715** is a microprocessor vulnerability that allows an attacker to trick a CPU's branch predictor into executing instructions along an incorrect ("speculative") path. While the CPU correctly discards the *results* of this misprediction, it fails to fully erase the *side effects* — most notably, changes to the CPU cache state. These residual cache changes can be measured using timing analysis, allowing an attacker to infer secret data that should never have been accessible.

Unlike traditional software bugs, Spectre exploits the **hardware design** of modern CPUs, making it extremely difficult to patch completely and requiring a combination of microcode, OS, and compiler-level mitigations.

---

## ⚙️ How the Attack Works

1. **Mistrain the branch predictor** — repeatedly execute a branch in a predictable pattern so the CPU learns to expect it.
2. **Trigger a misprediction** — force the CPU to speculatively execute a different, attacker-chosen path.
3. **Speculative out-of-bounds read** — the CPU speculatively accesses memory it shouldn't, pulling secret data into the cache before it realizes the mistake.
4. **Rollback & residue** — the CPU discards the speculative results, but the cache line touched during speculation remains "warm."
5. **Flush + Reload timing attack** — the attacker times memory accesses across the cache to detect which line was cached, and therefore recovers the secret byte-by-byte.

---

## 🖥️ Lab Environment

| Component | Details |
|---|---|
| **Operating System** | Ubuntu 14.04 LTS |
| **Kernel Version** | 4.4.0-148-generic |
| **CPU** | 12th Gen Intel® Core™ i5-12450H |
| **Virtualization** | VMware Workstation |
| **PoC Repository** | [crozone/SpectrePoC](https://github.com/crozone/SpectrePoC) |

---

## 🧪 Proof of Concept Walkthrough

### 1. Environment Setup
```bash
sudo apt update
sudo apt install git
git clone https://github.com/crozone/SpectrePoC
cd SpectrePoC
make
```

### 2. Identify CPU Vulnerability Status
Linux exposes CPU vulnerability/mitigation status directly through sysfs:
```bash
grep . /sys/devices/system/cpu/vulnerabilities/*
```
This confirmed the test CPU was **vulnerable to `spectre_v2`**, while other related vulnerabilities (Meltdown, L1TF, MDS) were either mitigated or not affected.

### 3. Execute the PoC
```bash
./spectre.out
```
The tool repeatedly reports `Success` results alongside a confidence "score," derived from cache-timing differences — each successful read represents one leaked byte of otherwise inaccessible memory, reconstructed entirely through the speculative side channel.

### 4. Analysis
- ✅ Successfully mistrained the branch predictor
- ✅ Speculatively executed unauthorized memory reads
- ✅ Used Flush+Reload timing analysis to reconstruct leaked bytes

---

## 🎥 Demo Video

A recorded walkthrough of the full PoC — from environment setup to successful data exfiltration — is included in this repository to visually validate the attack.

▶️ **[Watch the PoC Demo Video](./demo/spectre-poc-demo.mp4)**

> 📁 *Update the path above once the video file is added to your repository (e.g. place it in a `demo/` or `media/` folder and adjust the link accordingly).*

---

## 🛡️ Mitigation Strategies

- **Patch firmware & OS** — apply the latest microcode and kernel updates, which include retpoline and other speculation-barrier mitigations.
- **Follow vendor guidance** — Intel, AMD, and OS vendors publish specific mitigation instructions per CPU generation.
- **Enable OS/browser-level protections** — site isolation, `Indirect Branch Restricted Speculation` (IBRS), and similar mitigations reduce cross-boundary leakage.
- **Keep endpoint security current** — while not a direct fix, up-to-date security tooling helps detect exploitation attempts that pair Spectre with other attack chains.

---

## 📂 Repository Structure

```
.
├── README.md
├── Research_Paper_-_CVE-2017-5715_Spectre_by_Shivam_Bhatt.pdf
└── demo/
    └── spectre-poc-demo.mp4
```

---

## 📚 References

- crozone. (2023). *SpectrePoC*. GitHub. https://github.com/crozone/SpectrePoC
- Microsoft. (n.d.). *Update to enable mitigation against Spectre, Variant 2*.
- Wikipedia. (n.d.). *Spectre (security vulnerability)*. https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)
- Wikipedia. (n.d.). *Side-channel attack*. https://en.wikipedia.org/wiki/Side-channel_attack
- Wikipedia. (n.d.). *Row Hammer*. https://en.wikipedia.org/wiki/Row_hammer
- Twingate Team. (2024). *What is Row Hammer? How It Works & Examples*.

---

## 👤 Author

**Shivam Bhatt**
Cybersecurity Post-Graduate Diploma (Honours) — NAIT
🔗 Feel free to connect on [LinkedIn](#) or reach out for collaboration on cybersecurity research.


  ⭐ If you found this research useful, consider starring the repo!