Repository navigation
Expand file tree
/
Copy pathsok.sql
More file actions
3476 lines (3367 loc) · 405 KB
/
Copy pathsok.sql
File metadata and controls
3476 lines (3367 loc) · 405 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
-- phpMyAdmin SQL Dump
-- version 5.2.3
-- https://www.phpmyadmin.net/
--
-- Host: db
-- Generation Time: Oct 11, 2025 at 10:12 PM
-- Server version: 11.4.8-MariaDB-ubu2404
-- PHP Version: 8.3.26
SET SQL_MODE = "NO_AUTO_VALUE_ON_ZERO";
START TRANSACTION;
SET time_zone = "+00:00";
/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8mb4 */;
--
-- Database: `sok`
--
CREATE DATABASE IF NOT EXISTS `sok` DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_uca1400_ai_ci;
USE `sok`;
-- --------------------------------------------------------
--
-- Table structure for table `attacks`
--
CREATE TABLE `attacks` (
`id` int(11) NOT NULL,
`name` text NOT NULL,
`description` text NOT NULL,
`cve` varchar(128) DEFAULT NULL COMMENT 'Comma-separate if multiple',
`component` varchar(128) NOT NULL,
`requirements` text DEFAULT NULL,
`scope_same_address_space` tinyint(1) DEFAULT NULL COMMENT 'Does the attack work in a same-address-space scenario (e.g. within the same user-space process)',
`scope_cross_address_space` tinyint(1) DEFAULT NULL COMMENT 'Does the attack work in a (same-privilege-level) cross-address-space scenario (e.g. across user-space processes)',
`scope_cross_privilege_level` tinyint(1) DEFAULT NULL COMMENT 'Does the attack work in a (cross-address-space) cross-privilege scenario (e.g., leaking kernel memory to user space)',
`scope_cross_smt` tinyint(1) DEFAULT NULL COMMENT 'Does the attack work across SMT sibling cores?',
`scope_cross_core` tinyint(1) DEFAULT NULL COMMENT 'Does the attack work across (physical) cores?',
`scope_comment` text DEFAULT NULL,
`comment` text DEFAULT NULL,
`ready` tinyint(1) NOT NULL DEFAULT 0,
`created` timestamp NOT NULL DEFAULT current_timestamp(),
`updated` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci;
--
-- Dumping data for table `attacks`
--
INSERT INTO `attacks` (`id`, `name`, `description`, `cve`, `component`, `requirements`, `scope_same_address_space`, `scope_cross_address_space`, `scope_cross_privilege_level`, `scope_cross_smt`, `scope_cross_core`, `scope_comment`, `comment`, `ready`, `created`, `updated`) VALUES
(1, 'Prefetcher attack on shared memory/library', 'Attacker and victim share memory (e.g., shared library). The victim accesses shared memory, training and triggering the prefetcher in the victim context. The attacker inspects the cache state of the cache lines around the data buffer to infer the access pattern.', NULL, 'Hardware prefetcher', 'Secret-dependent accesses to shared memory', 1, 1, 1, 1, 1, 'Note that the attacker does not trigger the prefetcher in their own address space; they observe the prefetcher\'s activity in the cache state directly. Thus, cross-core attacks work if the LLC can be exploited for a cache attack.', NULL, 1, '2025-05-14 15:26:45', '2025-08-06 12:05:02'),
(3, 'Instruction address aliasing causes prefetcher state confusion', 'Some prefetchers associate learned patterns with (partial) addresses of the load instruction and/or the target buffer. An attacker can forge aliasing addresses in their own context and cause the prefetcher to confuse the attacker\'s context with the victim\'s. The prefetcher then uses a pattern learned in the victim context to control prefetch activity in the attacker context.', NULL, 'Hardware prefetcher', 'Hardware Prefetcher using addresses as index into their state table', 1, 1, 1, 0, 0, 'Cross-SMT/Cross-Core depends on whether the concrete prefetcher\'s state is shared across those domains or not. In the cases we are aware of, it is usually not shared.', NULL, 1, '2025-05-26 13:38:38', '2025-08-06 13:00:07'),
(4, 'Prime+Probe-like prefetcher attack (e.g., PrefetchX-evict)', '1. Attacker fills prefetcher\'s state to a known state;\n2. Victim runs and may or may not alter the prefetcher\'s state;\n3. Attacker probes prefetcher\'s state for existence of the primed state', NULL, 'Hardware prefetcher', NULL, 1, 1, 1, 1, 1, 'Cross-SMT/Cross-Core depends on whether the concrete prefetcher\'s state is shared across those domains or not. Often, it is not, but there are exceptions (e.g. Intel XPT prefetcher sharing cross-core).', 'In the PrefetchX paper, this attack is called PrefetchX-evict.', 1, '2025-05-27 14:57:36', '2025-08-06 13:00:34'),
(5, 'Branch-dependent cache attack', 'Side-channel attacks that carry information about a single bit, e.g., a bit that decides whether a branch is taken or not', NULL, 'Cache', NULL, 1, 1, 1, 1, 1, 'I assume these attacks are possible with Prime+Probe (i.e., cross-privilege and cross-AS) and the LLC (i.e., cross-core)', NULL, 1, '2025-05-27 15:14:02', '2025-08-05 14:53:18'),
(6, 'DMP (array-of-)pointer prefetcher exploitation', 'This prefetcher type detects when a sequence of pointers (or sometimes even a single pointer) is accessed in memory and checks the following memory locations. If those look like pointers as well, the prefetcher prefetches their target locations into the cache.\r\nSuch a prefetcher can be exploited in multiple ways. While the Augury paper discusses rather artificial same-process attacks, more elaborate attacks were presented later.\r\nFor example, the GoFetch paper introduces the following idea: The attacker provides specially crafted inputs to a victim process. These inputs are designed such that certain intermediate values in the victim\'s computation resemble a pointer if (and only if) a certain (secret-dependent) property is fulfilled. The prefetcher is only activated when the condition is fulfilled, which leaks information about the secret through the prefetcher.', NULL, 'Hardware Data Prefetcher (DMP)', 'DMP prefetcher', 1, 1, 0, 0, 0, 'The DMP implementations we are aware of do not share state across SMT/cores.', NULL, 1, '2025-05-28 08:14:03', '2025-08-06 13:02:00'),
(7, 'Use prefetcher to trigger attacker-controlled prefetch in victim context (ShadowLoad)', 'The prefetcher is pre-trained in the attacker context. It is trained such that, when a victim process performs a specific load instruction, the prefetcher is activated and prefetches a specific address in the victim context. This targeted pre-training is achieved through aliasing. The goal is to bring an attacker-controlled address into the cache, which can be used to strengthen other attacks (e.g., Microarchitectural Data Sampling (MDS)).', NULL, 'Hardware data prefetcher', 'Good knowledge of the prefetcher activation criteria and its data structures (for aliasing)', 1, 1, 1, 0, 0, NULL, NULL, 1, '2025-05-28 14:15:02', '2025-08-05 14:53:44'),
(9, 'Leaking single loads through prefetcher state (FetchProbe)', '1. Victim either performs a (single) load which starts a prefetch pattern (associated (partial) addresses internally) or not.\r\n2. Attacker performs aliasing accesses that would trigger the prefetcher iff the load in step 1 happened.\r\nThis allows an attacker to monitor a memory address (for example).', NULL, 'Hardware data prefetcher', 'Good knowledge of prefetcher activation criteria', 1, 1, 1, 0, 0, NULL, NULL, 1, '2025-05-28 15:10:24', '2025-08-05 14:53:44'),
(10, 'Spectre-PHT (variant 1, input validation bypass)', 'Spectre attack on the Pattern History Table (PHT) of a branch predictor. The branch predictor is mis-trained so that it will mispredict the outcome of a conditional and thus, for example, bypass a bounds check. This enables transient out-of-bounds reads or writes. Limited to same-address-space attacks.', 'CVE-2017-5753', 'Branch predictor, Pattern History Table (PHT)', 'Vulnerable code gadget in victim code (including a vulnerable conditional and covert channel extraction)', 1, 1, 1, 1, 0, 'For the cross-* scopes: AFAIK you need to forge a branch history and low bits of the PC (i.e., aliasing), which might be relatively hard, but not impossible to do. Also, the PHT appears to be shared across SMT threads on old CPUs (without patches) and only newer CPUs have partitioning OOTB', NULL, 1, '2025-05-30 10:12:45', '2025-10-10 19:21:35'),
(11, 'Spectre-BTB (variant 2, branch target injection, Spectre-BTI)', 'Spectre attack on the Branch Target Buffer (BTB) of a branch predictor, which stores targets of indirect branches. The branch predictor is mistrained in the attacker context so that it mispredicts the destination address of an indirect branch in the victim context. This allows ROP-like transient execution in the victim context. The predictor can be trained across processes, but all branch target and data addresses must be accessible to the victim process.', 'CVE-2017-5715', 'Branch predictor, Brach Target Buffer (BTB)', 'Vulnerable code gadgets in victim code (gadgets can be chained (ROP-like))', 1, 1, 1, 1, 0, NULL, NULL, 1, '2025-05-30 10:12:45', '2025-08-05 14:53:44'),
(12, 'Spectre-STL (variant 4, Spectre-SSB, speculative store bypass)', 'Mispredictions by the CPU\'s memory disambiguator in the context of store-to-load forwarding allow transient access to stale values. If the disambiguator wrongly predicts that a load has no dependencies to prior stores, the load is transiently served with stale data from the L1 cache, which can then be leaked through a cache side channel.', 'CVE-2018-3639', 'Memory disambiguator', NULL, 1, 0, 0, 0, 0, 'Intel proposes Process Isolation as countermeasure [DOC64], so I suppose only same-address-space attacks are possible.', NULL, 1, '2025-05-30 10:12:45', '2025-10-10 19:25:51'),
(13, 'Meltdown-US (original Meltdown, Spectre variant 3)', 'TODO', 'CVE-2017-5754', 'Out-of-order execution', NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, 0, '2025-06-02 12:32:56', '2025-10-06 07:44:49'),
(14, 'Retbleed on Intel (Return Stack Buffer Underflow)', 'On Intel CPUs (the Retbleed paper considers Haswell to Alder Lake), the branch predictor uses the Branch Target Buffer (BTB) to predict the target of a return (ret) instruction in certain situations instead of the Return Stack Buffer (RSB). In particular, this happens when the RSB underflows. An RSB underflow can be caused by deep call stacks, i.e., by nesting more function calls (and respective returns) than the RSB can store. This finding implies that ret instructions can be exploited similar to Spectre variant 2. It also invalidates the assumption of the retpoline defense that ret instructions are not predicted through the BTB.', 'CVE-2022-29901', 'Branch predictor, Branch Target Buffer (BTB), Return Stack Buffer (RSB)', NULL, 1, 1, 1, 0, 0, 'For cross-SMT: Literature is not very explicit about this, but neither STIBP nor disabling SMT is mentioned as recommended mitigations for Intel CPUs, we assume that cross-SMT attacks are not possible.', NULL, 1, '2025-06-03 13:38:58', '2025-08-07 08:18:02'),
(15, 'Retbleed on AMD', 'On AMD CPUs (the Retbleed paper considers Zen 1 to Zen 2), the branch predictor uses the Branch Target Buffer (BTB) to predict the target of a return (ret) instruction in certain situations instead of the Return Stack Buffer (RSB). In particular, when both the BTB and the RSB contain a valid entry for a given ret instruction, the BTB entry takes precendence. This finding implies that ret instructions can be exploited similar to Spectre variant 2. It also invalidates the assumption of the retpoline defense that ret instructions are not predicted through the BTB.', 'CVE-2022-29900', 'Branch predictor, Branch Target Buffer (BTB), Return Stack Buffer (RSB)', NULL, 1, 1, 1, 1, 0, NULL, NULL, 1, '2025-06-04 12:51:54', '2025-08-05 14:53:45'),
(16, 'Spectre-BHB (Branch History Injection (BHI), Intra-Mode Branch Target Injection (Intra-Mode BTI))', 'This attack exploits that some hardware defenses against Spectre v2 only partition the Branch Target Buffer (BTB) along privilege levels, but not other related buffers. Through this spearation, branch targets cannot directly be mistrained from a lower privilege level; however, as the Branch History Buffer (BHB) remains unpartitioned, its value can still be manipulated from lower privilege levels. Since the current BHB value is used as an index into the BTB to select an entry and the respective prediction target, exploitation is still possible.\nConsider the following example. A user-space attacker wants to trick the branch predictor into transiently executing one specific syscall in kernel space. To mistrain the predictor, the attacker crafts a specific branch history (in user space) and executes the target syscall afterwards (thus linking the specific branch history with the specific syscall).\nThen, when a victim process later encounters the same branch history and triggers a syscall, the first branches after kernel switch will be predicted based on the previously mistrained branch history -- the previously trained syscall will transiently be executed (instead of the one that the victim process requested).\nNote that both mistraining and misprediction happen in kernel space (even though the attacker contributes the BHB value from user space).\nThis works even with Intel eIBRS or ARM CSV2 in place. AMD\'s always-on IBRS implementation prevents this attack though.\n(Only) on Intel CPUs, the branch predictor can be trained out-of-place, i.e., with any indirect branch instruction (only the BHB value needs to be identical).\nIf this attack is applied across privilege levels (inter-mode, e.g., user-to-kernel), Intel calls it \"Branch History Injection (BHI)\" and Arm calls it \"Spectre-BHB\". If the attack is applied within the same privilege level (intra-mode, e.g., kernel-to-kernel), Intel calls it \"intra-mode BTI\" and Arm calls it \"kernel-only Spectre-BHB\".', 'CVE-2022-0001 (Intel, BHI), CVE-2022-0002 (Intel, intra-mode BTI), CVE-2022-23960 (Arm)', 'Branch predictor, Branch History Buffer (BHB)', 'Vulnerable Intel CPU (even with eIBRS in place) or vulnerable Arm CPU (even with CSV2 in place)', 1, 1, 1, 1, 0, 'Literature is not 100% clear about whether the BHB is shared across SMT threads or not; my current interpretation is that it is shared.', NULL, 1, '2025-06-10 14:00:54', '2025-08-07 08:39:15'),
(17, 'Spectre-PHT variant 1.1 (bounds check bypass on stores, BCBS, speculative buffer overflow)', 'Similar to Spectre-PHT (variant 1), but with a transient store (instead of load) after the misspeculated branch. Due to the store, a memory location can be speculatively overwritten.\nIf the overwritten location contains a control-flow address (e.g., function pointer or return address), this may alter the subsequent speculative control flow (in the same speculative execution window).\nIf the overwritten location contains a data pointer, it may provide an attacker a primitive to choose a memory location to leak from.\nEither way, the speculatively stored data is transferred to the later load instructions via speculative store-to-load forwarding.', 'CVE-2018-3693', 'Branch predictor, PHT', NULL, 1, 1, 1, 1, 0, NULL, NULL, 1, '2025-06-12 10:33:41', '2025-10-10 19:29:22'),
(18, 'Spectre-RSB', 'A return stack buffer (RSB) facilitates the prediction of function return addresses. When a call instruction is issued, the return address is pushed onto the RSB. When a return instruction is issued, the top-most RSB entry can be used to (speculatively) predict the return address.\nSpectre-RSB exploits that the RSB may get out of sync with the actual control flow. An attacker can cause such a de-synchronization across processes or privilege levels: they place an attacker-specified address on top of the RSB and yield the CPU to the victim context. Upon a return instruction in the victim context, control flow transiently returns to the attacker-specified address. To increase the size of the speculation window, the stack location that keeps the actual return address in the victim context should be evicted from cache.', NULL, '', NULL, 1, 1, 1, 0, 0, 'No cross-SMT: according to ret2spec [DOC41], the RSB is separate/partitioned per SMT thread.', 'Variant of Spectre v2.', 1, '2025-06-12 10:43:25', '2025-08-07 10:22:09'),
(19, 'Meltdown-GP (Spectre variant 3a, Rogue System Register Read)', 'A read from a system register that is architecturally inaccessible at the current privilege level is served during transient execution.', 'CVE-2018-3640', '', NULL, NULL, NULL, NULL, NULL, NULL, NULL, 'TODO: double-check after looking more into Meltdown-type attacks', 0, '2025-06-12 11:27:26', '2025-06-27 15:02:48'),
(20, 'Meltdown-RW (Spectre variant 1.2)', 'This attack exploits that pages marked \"read-only\" in the page table can be written to during speculative execution. Attackers have to fit the forbidden write as well as code that reads from the modified read-only location into the same speculative execution window. The attacker-manipulated data from the transient store is then forwarded to the transient load via store-to-load forwarding. If the overwritten data is a code pointer (e.g., function pointer, vtable address), the attacker can divert the transient control flow.', NULL, 'Out-of-order execution, Store buffer', NULL, NULL, NULL, NULL, NULL, NULL, NULL, 'Root cause is a missing permission check during speculative execution. While this attack was initially presented as Spectre variant 1.2, later works classified it as Meltdown-style attack. In fact, it is very similar to the original Meltdown attack: while original Meltdown exploits that the US (User/Supervisor) page table bit is not respected during speculative execution, this attack exploits the same for the RW (read/write) bit.', 0, '2025-06-25 13:20:49', '2025-08-05 13:56:34'),
(21, 'Branch Privilege Injection (BPI, Branch Predictor Race Conditions, BPRC)', 'A variant of Spectre v2 that exploits that microarchitectural buffers may be updated asynchronously. On some Intel CPUs, the Branch Target Buffer (BTB) is not instantly updated when a branch instruction retires, but asynchronously after a short delay. If a privilege domain switch occurs during this time, the update to the BTB\'s state is associated with the new privilege domain that was switched to. This general principle can be applied to various privilege domain switches, but three variants are especially relevant:\n- BPRC_{U->K}: Mis-training in user space, mis-prediction in kernel (supervisor mode).\n- BPRC_{G->H}: Mis-training in guest mode, mis-prediction in hypervisor mode.\n- BPRC_{IBPB}: Mis-training before an IBPB barrier, mis-prediction afterwards.\nSince the BTB stores only partial addresses, mis-training can be carried out in less privileged modes with aliasing branches.', 'CVE-2024-45332', 'Branch Predictor, Branch Target Buffer (BTB)', 'Vulnerable Intel CPU', 1, 1, 1, 1, 0, 'Cross-SMT is not really clear from literature. Since the attack relies on the BTB, we use Spectre-BTB (aka variant 2) as reference and assume cross-SMT attacks are possible if STIBP is absent.', NULL, 1, '2025-07-16 14:43:14', '2025-08-07 12:07:42'),
(22, 'Reptar (Instruction Decoding Bug on Intel CPUs)', 'A bug in some Intel CPUs that leads to wrong instruction decoding.\nIn particular, the following misbehaving example was found: the error condition occurs when a `rep movsb` (move string) instruction is prefixed with an `rex.r` prefix. The `rex.r` prefix does not make sense for the `rep movs` instruction (rex is only used for instructions with register operands, but `rep movs` does not have any operands). Normally, redundant or nonsensical prefixes should be ignored. In this case, however, the `rex.r` prefix corrupts the microarchitectural state of the CPU, leading to unexpected behavior in subsequent code or even crashes, especially when exploited multiple times in parallel (on parallel SMT threads or cores). The researchers hypothesize that the CPU frontend, which is responsible for decoding the instruction, miscalculates the size of the `movs` instruction and causes subsequent entries in the reorder buffer (ROB) to be associated with incorrect addresses.\nThe bug can at least be used for DoS purposes; it is unclear whether the state corruption can also lead to privilege escalation.', 'CVE-2023-23583', 'Frontend/Decode', 'Vulnerable Intel CPU', 1, 1, 1, 1, 0, 'No exploit demonstrated, only a DoS primitive was demonstated', NULL, 1, '2025-08-05 09:24:37', '2025-08-18 07:34:58');
-- --------------------------------------------------------
--
-- Table structure for table `defenses`
--
CREATE TABLE `defenses` (
`id` int(11) NOT NULL,
`name` text NOT NULL,
`description` text NOT NULL,
`requirements` text DEFAULT NULL COMMENT 'Prerequisites to use/apply this defense',
`constraints` text DEFAULT NULL COMMENT 'Limitations of the defense, e.g., can only be used against certain kinds of attacks',
`hw_sw` varchar(128) NOT NULL COMMENT 'HW=Hardware defense,\r\nSW=software defense,\r\nMC=Microcode defense,\r\n"+"=Co-design,\r\n","=either-or',
`modified_component` varchar(128) DEFAULT NULL COMMENT 'Which HW or SW component needs to be modified to implement the defense (if any)?',
`human_interaction` varchar(128) NOT NULL COMMENT 'Is regular human interaction required to apply this defense? If so, by whom (e.g., Developer, End User)',
`scope_same_address_space` tinyint(1) DEFAULT NULL COMMENT 'Is the attack mitigated in a same-address-space scenario (e.g. within the same user-space process)',
`scope_cross_address_space` tinyint(1) DEFAULT NULL COMMENT 'Is the attack mitigated in a (same-privilege-level) cross-address-space scenario (e.g. across user-space processes or from user-space to kernel)',
`scope_cross_privilege_level` tinyint(1) DEFAULT NULL COMMENT 'Is the attack mitigated in a (cross-address-space) cross-privilege scenario (e.g., leaking kernel memory to user space)',
`scope_cross_smt` tinyint(1) DEFAULT NULL COMMENT 'Does the defense mitigate the attack across SMT sibling cores?',
`scope_cross_core` tinyint(1) DEFAULT NULL COMMENT 'Does the defense mitigate the attack across (physical) cores?',
`scope_comment` text DEFAULT NULL,
`comment` text DEFAULT NULL,
`ready` tinyint(1) NOT NULL DEFAULT 0,
`created` timestamp NOT NULL DEFAULT current_timestamp(),
`updated` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci;
--
-- Dumping data for table `defenses`
--
INSERT INTO `defenses` (`id`, `name`, `description`, `requirements`, `constraints`, `hw_sw`, `modified_component`, `human_interaction`, `scope_same_address_space`, `scope_cross_address_space`, `scope_cross_privilege_level`, `scope_cross_smt`, `scope_cross_core`, `scope_comment`, `comment`, `ready`, `created`, `updated`) VALUES
(1, 'Disable prefetcher selectively (PreFence)', 'OS Scheduler is extended to allow temporary per-process disabling of the prefetcher. Applications indicate beginning/end of critical computations through syscalls. ', 'Prefetcher can be disabled temporarily and doesn\'t learn while disabled', NULL, 'SW', 'OS kernel (scheduler)', 'Developer', 0, 1, 0, 1, 1, 'Not cross-privilege, since PreFence is designed to be used by user-space processes, not the kernel. In the same-address-space scenario, an attacker has control over the prefetcher\'s activation state.', NULL, 1, '2025-05-14 15:27:11', '2025-10-09 10:51:33'),
(3, 'Disable prefetcher permanently', 'Disabled prefetcher does not trigger prefetches (= no observable secret-dependent activity) and ideally also does not learn (= no transferring secrets into the prefetcher\'s state)', 'CPU needs to provide an MSR to control the prefetcher.', NULL, 'HW+SW', 'Hardware prefetcher', 'None', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-05-26 11:59:52', '2025-08-07 13:16:49'),
(4, 'Constant-time programming', 'Do not perform secret-dependent memory accesses or branches', NULL, NULL, 'SW', 'Source code', 'Developer', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-05-26 12:05:10', '2025-08-07 13:16:49'),
(5, 'Do not share shared libraries in memory', 'Instead of sharing a single copy of a library in memory between multiple processes, let each process load its own copy to memory. This prevents shared cache state of library cache lines between multiple processes.', NULL, NULL, 'SW', 'Dynamic loader', 'None', 0, 1, 1, 1, 1, NULL, NULL, 1, '2025-05-26 12:16:29', '2025-10-10 19:45:51'),
(6, 'Cache/State Partitioning along process IDs', 'Partition a microarchitectural cache or state along process IDs/address-space IDs (ASIDs)', NULL, NULL, 'HW+SW', 'Microarchitectural cache/state, OS kernel (protection domain assignment)', 'None', 0, 1, 1, 0, 0, NULL, NULL, 1, '2025-05-26 13:25:07', '2025-08-07 13:16:49'),
(7, 'Oblivious Execution', 'Execute all paths of conditionals, but only persist the results of the \"correct\" one.', NULL, 'Very high performance impact', 'SW', 'Compiler', 'None', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-05-26 13:48:26', '2025-08-07 13:16:49'),
(8, 'Reduce timer resolution', 'Microarchitectural attacks often rely on high-resolution timers. Making those timers less precise makes attacks more difficult. This can be achieved by reducing the timer resolution and/or adding random jitter.', NULL, NULL, 'HW, SW', 'Hardware timer, interpreter/sandbox', 'None', 1, 1, 1, 1, 1, NULL, 'Can be implemented in Hardware (e.g., CPUs) or Software (e.g., sandboxes) depending on the context.', 1, '2025-05-26 13:58:05', '2025-08-07 13:16:49'),
(9, 'Clear prefetcher state on context switch', 'To separate contexts, the prefetcher\'s state can be cleared when switching contexts.\nThis can either be implemented as a explicit instruction/MSR, or as an instruction sequence that fills the state with harmless data.', 'clear-prefetcher instruction or instruction sequence that is guaranteed to clear the prefetcher\'s state', NULL, 'HW+SW, SW', 'Hardware prefetcher, OS kernel (scheduler)', 'None', 0, 1, 0, 0, 0, 'Does only work if attacker and victim are separated by a context switch.', NULL, 1, '2025-05-26 14:38:14', '2025-08-07 13:16:49'),
(10, 'Special load instruction without side effects', 'Extend the ISA to implement a load instruction that does not have observable side effects, such as training the prefetcher, modifying the cache, etc. This instruction can then be used in security-critical code sections.', NULL, NULL, 'HW+SW', 'ISA, Source code', 'Developer', 1, 1, 1, 1, 1, NULL, 'Proposed by FetchBench specifically as a load instruction that does not train the prefetcher. Generalized it a bit here.', 1, '2025-05-27 13:27:16', '2025-08-07 13:16:49'),
(11, 'Use full instead of partial addresses as indices into microarchitectural buffers', 'Some attacks exploit aliasing addresses to mislead a microarchitectural component and make it confuse two contexts. The goal is to make aliasing harder.', NULL, NULL, 'HW', 'Microarchitectural buffer (e.g. prefetcher state)', 'None', 0, 1, 1, 1, 1, 'same AS: It depends on the specific case, but a same-AS attacker may be able to train the predictor \"in-place\", i.e., with the original branch ', NULL, 1, '2025-05-27 13:35:22', '2025-10-10 19:51:13'),
(12, 'Schedule security-critical code on cores where the vulnerable component is not present', 'For example, disable a vulnerable microarchitectural component on one of the cores and run security-critical processes there. Or schedule security-critical processes on efficiency cores that do not implement a complex, vulnerable microarchitectural component (e.g., a prefetcher).', 'A secure core needs to be present in the system or it must be possible to configure one of the cores as a secure one.', NULL, 'HW+SW', 'OS kernel (scheduler)', 'None', 1, 1, 1, 1, 1, 'same AS: would require re-scheduling the whole process', NULL, 1, '2025-05-28 08:29:22', '2025-10-10 19:52:57'),
(13, 'Co-Scheduling', 'Assign protection domains to processes and ensure that only processes from the same protection domain ever share a core (or a pair of SMT sibling cores)', 'Processes have to be assigned protection domains, scheduler needs to implement a respective scheduling strategy.', NULL, 'SW', 'OS kernel (scheduler, protection domain assignment)', 'None', 0, 1, 1, 1, 0, NULL, NULL, 1, '2025-05-28 08:31:52', '2025-08-07 13:16:49'),
(14, 'Isolate secrets into separate address spaces', 'To prevent attacks that only work in the same address space, move secrets into separate address spaces that attackers cannot control. Example: Sandboxing in browsers.', NULL, 'Only works for same-address-space attacks', 'SW', 'Software architecture', 'Developer', 1, 0, 0, 0, 0, NULL, NULL, 1, '2025-05-28 08:59:00', '2025-10-10 20:00:58'),
(15, 'Exploiting prefetcher implementation details as defense', 'Some prefetchers have implementation details/quirks that can be exploited as a defense. For example, if a prefetcher does not activate on certain memory addresses, security-critical processes could use exactly those addresses to evade the area of influence of the buggy component.\nSuch defenses are often considered rather unstable, because the underlying implementation details can change at any time without notice (e.g., through microcode updates or new hardware revisions) or may not be fully understood in the first place.', 'Implementation details need to be well-understood', NULL, 'SW', 'Application software, OS kernel', 'None', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-05-28 09:17:19', '2025-10-09 10:53:16'),
(16, 'Remove code gadgets that activate a microarchitectural component', 'For example, remove code gadgets that trigger a certain type of prefetcher', 'In-depth knowledge of the microarchitectural component to identify relevant gadgets', 'Relevant gadgets may be implementation-specific', 'SW', 'Source code', 'Developer', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-05-28 09:45:40', '2025-08-07 13:16:50'),
(17, 'Blinding', 'Add a (typically random) masking value to sensitive values before they are stored to memory (i.e., before they travel through the cache hierarchy). Remove the mask after loading the value back from memory.\r\nIn classic power side-channel attacks, this makes the power consumption of the bus independent from the sensitive values.\r\nIn other microarchitectural attack scenarios, blinding can be used to make sensitive values less predictable.', NULL, NULL, 'SW', 'Source code', 'Developer', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-05-28 12:10:02', '2025-08-07 13:16:50'),
(18, 'Constrain prefetcher to specific memory regions', 'Add configuration options to the prefetcher which constrain the prefetcher to certain buffers or memory regions.', NULL, NULL, 'HW+SW', 'Hardware data prefetcher, OS kernel or application source code (depends on who configures the prefetcher)', 'Developer', 1, 1, 1, 1, 1, NULL, 'Inverse of DEF19', 1, '2025-05-28 12:35:14', '2025-10-09 18:07:33'),
(19, 'Mark specific memory regions non-prefetchable', 'Use memory types to set specific memory regions non-prefetchable (similar to uncacheable memory)', NULL, NULL, 'HW+SW', 'CPU memory controller, hardware prefetcher, OS kernel, application software', 'Developer', 1, 1, 1, 1, 1, NULL, 'Inverse of DEF18', 1, '2025-05-28 14:27:22', '2025-08-07 13:16:50'),
(20, 'Update microcode to add privilege level separation to prefetchers (like IBRS)', 'Introduce a new MSR that can be set to disallow the prefetcher to use predictions across security domains, similar to IBRS for Spectre.', NULL, NULL, 'MC+SW', 'Microcode, OS kernel', 'None', 0, 0, 1, 0, 0, NULL, NULL, 1, '2025-05-28 14:39:01', '2025-10-10 20:05:02'),
(21, 'Disable speculative execution permanently', 'Set a CPU flag to disable speculative execution.', 'Requires hardware support (i.e., a respective flag/MSR)', NULL, 'HW+SW', 'CPU', 'None', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-05-30 12:30:36', '2025-08-07 13:16:50'),
(22, 'Insert serializing instruction (such as lfence) to block speculative execution', 'A program can issue a serializing instruction, such as lfence, as a barrier to block speculative execution. Specifically, instructions following the barrier are not executed -- not even speculatively -- until all prior instructions have completed.\nSerializing instructions can be added at different levels of granularity.\nFor example, to defend against Spectre variant 1, a serializing instruction could be added as the first instruction in each branch of conditionals, effectively disabling branch prediction. However, this comes with high performance cost.\nAs a trade-off, developers or compilers can insert serializing instructions selectively, for example when known-vulnerable patterns occur. This allows for higher overall performance, but risks missing vulnerable branches that go undetected.\nTo defend against Spectre variant 2, place a serializing instruction before an indirect branch.\nTo prevent straight-line speculation, place a speculation barrier just after ret/call/jmp instructions.', 'Serializing instruction acting as speculation barrier. On AMD, an MSR needs to be set to make lfence \"dispatch serializing\" [DOC32, Mitigation G-2].', 'When applied selectively, vulnerable branches may be missed.', 'SW', 'Source code and/or binary', 'None or Developer (depending on automated vs. manual placement of serializing instructions)', 1, 1, 1, 1, 0, NULL, NULL, 1, '2025-05-30 12:37:42', '2025-10-10 20:03:44'),
(23, 'Index masking as additional bounds check', 'In addition to a traditional out-of-bounds check (if idx < length), apply a mask to the index when using it (array[idx & mask]). The mask is chosen such that it roughly corresponds with the length of the array (obviously, this is only precise if the length of the array is a power of 2).', NULL, 'Only complete if the array length is a power of 2. Otherwise, speculative out-of-bounds accesses are constrained, but not fully prevented.', 'SW', 'Source Code (if manual), Compiler (if automated)', 'Developer (if manual)', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-05-30 12:50:15', '2025-08-07 13:16:50'),
(24, 'Pointer Poisoning', 'Due to Spectre v1, a CPU may misspeculate on type checks, causing transient type confusions. Pointer poisoning prevents this as follows. Data pointers are XORed with a type-specific poison value. Before a poisoned pointer can be used, the correct poison value has to be XORed to it again. If a type confusion happens due to a misspeculation during speculative execution, the selected poison value will be wrong (belongs to a different type), resulting in an invalid pointer.', NULL, NULL, 'SW', 'Source code', 'Developer', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-05-30 13:03:54', '2025-08-07 13:16:50'),
(25, 'Prevent use of speculatively fetched data in subsequent operations', 'Update CPUs (in hardware or microcode) such that data that was fetched during speculative execution cannot be used in subsequent operations.', NULL, NULL, 'HW, MC', 'CPU', 'None', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-05-30 13:06:18', '2025-08-07 13:16:50'),
(26, 'Indirect Branch Restricted Speculation (IBRS) (incl. eIBRS, AutoIBRS)', 'ISA extension that prevents indirect branches in privileged code (e.g., the kernel) from being affected by indirect branches in unprivileged code (e.g., user space).\nWhile basic IBRS needs to be enabled/disabled every time when the kernel is entered/exited (through MSR writes), later extensions (eIBRS/AutoIBRS) feature an \"always-on\" mode that only needs to be enabled once.', 'CPU implementing IBRS', 'Only protects privileged from non-privileged code, no inner-domain protection (IBPB on context switch may help for that). On Intel, IBRS is a superset of STIBP, so STIBP does not need to be enabled when IBRS is enabled [DOC20].', 'HW+MC+SW', 'CPU, Microcode, OS kernel', 'None', 0, 0, 1, 0, 0, 'Prevents user-space to kernel attacks', NULL, 1, '2025-05-30 13:18:50', '2025-10-10 20:05:53'),
(27, 'Indirect Branch Predictor Barrier (IBPB)', 'Prevent software running before the barrier from affecting the indirect branch prediction state of software running after the barrier (e.g. by flushing the BTB). It was introduced to be used on context switch to prevent cross-process attacks within the same privilege level.', 'CPU supporting IBPB', NULL, 'HW+MC+SW', 'CPU', 'Developer', 1, 1, 0, 0, 0, NULL, NULL, 1, '2025-05-30 13:22:43', '2025-08-07 13:16:50'),
(28, 'Single Thread Indirect Branch Predictors (STIBP)', 'Prevents sharing of the branch predictor\'s state between processes on sibling SMT threads. Similar to IBRS, STIBP is a processor state that can be enabled and disabled by writing to a register.', 'CPU implementing STIBP', 'Only prevents cross-SMT-thread leakage; On Intel, IBRS is a superset of STIBP, so STIBP does not need to be enabled when IBRS is enabled [DOC20].', 'HW+MC+SW', 'CPU, OS kernel, Source code', 'Developer', 0, 0, 0, 1, 0, NULL, NULL, 1, '2025-05-30 13:28:31', '2025-10-10 20:06:36'),
(29, 'Retpoline (\"Generic\" variant)', 'Defense against mis-speculation on indirect branch targets because of a mis-trained Branch Target Buffer (BTB) entry.\nThe idea is to replace indirect jumps (which are predicted based on the BTB) with a special, safe code sequence. This code sequence traps speculative execution in an infinite loop, while still jumping to the desired target address architecturally.\nSpecifically, a standard retpoline uses a return (ret) instruction to replace the actual indirect jump. Return instructions are (primarily) predicted based on the Return Stack Buffer (RSB) instead of the BTB. The retpoline code sequence (1) puts the jump target address on the stack, so that the return instruction (architecturally) jumps there, and (2) poisons the RSB before issuing the return instruction, so that speculative execution jumps into an infinite loop.\nThe Retbleed paper later partially invalidated retpolines, as it showed that when the RSB underflows, the Branch Target Buffer (BTB) may be used on some CPUs to predict return targets as well. Behavior differs on Intel and AMD. See entries on Retbleed for more details. On newer Intel processors, the prediction behavior when the RSB is empty can be controlled; when using retpolines on those systems, software should set the RRSBA_DIS_S/RRSBA_DIS_U flags [DOC35].', 'The CPU must predict the targets of ret instructions through the a well-understood Return Stack Buffer, which can be poisoned reliably by the retpoline.\nIntel recommends retpolines on CPUs that do not support eIBRS (as IBRS is very expensive and retpolines are considered more performant) [DOC23].\nSimilarly, AMD recommends retpolines as software mitigation against Spectre v2 [DOC32].', 'Retpolines mitigate basic Spectre v2, but leave the CPU vulnerable to Retbleed. On some Intel CPUs (especially Goldmont Plus and Tremont), retpolines are not fully effective according to Intel [DOC23].\nIncompatible with Intel CET-SS (shadow stack) [DOC35].', 'SW', 'Source code, compiler', 'None (assuming automated application through the compiler)', 1, 1, 1, 1, 0, NULL, NULL, 1, '2025-05-30 13:37:10', '2025-10-09 10:44:51'),
(30, 'RSB stuffing when deep call stacks occur', 'To prevent an underflow of the Return Stack Buffer (RSB), employ a counter that counts the depth of call stacks and refill it with harmless return targets (e.g., the address of a delaying PAUSE/LFENCE sequence, similar to retpoline) once a threshold is crossed.', 'Retbleed-vulnerable Intel CPU', NULL, 'SW', 'OS kernel', 'None', 1, 1, 1, 0, 0, NULL, NULL, 1, '2025-06-04 13:14:34', '2025-08-07 13:16:50'),
(31, 'jmp2ret (AMD Retbleed defense proposal)', 'Replace returns in the kernel with a direct jump to a single ret instruction. The BTB entry for this ret instruction is invalidated on kernel entry.', 'Retbleed-vulnerable AMD CPU (Zen 1/2)', NULL, 'SW', 'OS kernel', 'None', 0, 1, 1, 0, 0, NULL, NULL, 1, '2025-06-04 13:23:17', '2025-08-07 13:16:50'),
(32, 'Supervisor Mode Execution Protection (SMEP)', 'A processor feature of Intel CPUs (and newer AMD CPUs [DOC32]). Equivalent on ARM: PXN (Privileged Execute Never).\nIf enabled, supervisor-mode code (i.e., kernel code) cannot fetch instructions from user-mode (= user-space) pages. This prevents execution of user-space code in kernel space.', 'CPU that implements SMEP', NULL, 'HW+SW', 'CPU, OS kernel', 'None', 0, 0, 1, 0, 0, NULL, NULL, 1, '2025-06-04 15:42:51', '2025-10-10 20:10:46'),
(33, 'Supervisor Mode Access Protection (SMAP)', 'A processor feature of Intel CPUs (and newer AMD CPUs [DOC32]). Equivalent on ARM: PAN (Privileged Access Never).\nIf enabled, supervisor-mode code (i.e., kernel code) cannot access user-mode (= user-space) pages.', 'CPU that implements SMAP', NULL, 'HW+SW', 'CPU, OS kernel', 'None', 0, 0, 1, 0, 0, NULL, NULL, 1, '2025-06-04 15:42:51', '2025-10-10 20:11:36'),
(34, 'RSB stuffing on entering privileged mode', 'To clear the Return Stack Buffer (RSB) from potentially injected malicious return targets, the RSB is filled with harmless target addresses (e.g., to a delaying PAUSE/LFENCE sequence, similar to retpoline) when switching to a higher privilege mode.', 'CPU that implements a vulnerable RSB', NULL, 'SW', 'OS kernel', 'None', 0, 0, 1, 0, 0, NULL, NULL, 1, '2025-06-04 16:05:50', '2025-10-10 20:12:34'),
(35, 'Add data dependency on the outcome of a compare to avoid speculation', 'Consider a comparison that controls a conditional jump (e.g., a bounds check). After the jump, an instruction with a data dependency on the result of the comparison can be added. This has a similar effect to adding a serializing instruction (such as lfence), as the processor cannot speculate past the instruction until the data dependency is resolved.', NULL, 'Constrained to this particular code pattern (comparison + jump)', 'SW', 'Compiler', 'None', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-06-04 16:13:05', '2025-10-09 18:12:40'),
(36, 'Retpoline (AMD\'s LFENCE/JMP variant)', 'Similar to \"generic\" Retpoline, this is an instruction sequence that indirect jumps can be replaced with, with the goal of mitigating Spectre v2 attacks. In contrast to \"generic\" Retpolines, the replacement sequence is simpler: instead of trapping speculative execution, this sequence only loads the target address, serializes execution using lfence, and then performs the jmp as normal.\nInitially, it was believed that the lfence reduces the speculative execution window sufficiently (on AMD CPUs) to make exploitation impossible. This was later found to be wrong (at least for some AMD CPUs).', 'AMD CPU', NULL, 'SW', 'Source code, compiler', 'None', 1, 1, 1, 1, 0, NULL, NULL, 1, '2025-06-06 10:07:22', '2025-10-10 20:13:33'),
(37, 'Invalidate branch predictor state on privilege mode switch', 'Invalidate the state when the privilege mode is switched, for example through a specific instruction, instruction sequence, or other workaround.', 'Means of reliably invalidating the branch predictor', NULL, 'SW', 'OS kernel', 'None', 0, 0, 1, 0, 0, NULL, NULL, 1, '2025-06-10 14:26:24', '2025-10-10 20:13:57'),
(38, 'Intel CET-IBT (Control-Flow Enforcement Technology - Indirect Branch Tracking)', 'Prevents architectural execution and *limits* speculative execution of indirect branch targets that do not start with an ENDBR32/64 instruction, reducing the number of gadgets available to an attacker.\nIn older implementations, up to 7 instructions may be speculatively executed. In newer implementations, speculative execution is blocked completely [DOC45, Section 8.1].', 'CPU supporting Intel CET-IBT, Compiler supporting ENDBR instruction placement', NULL, 'HW+SW', 'CPU, Compiler', 'None', 1, 0, 0, 0, 0, NULL, NULL, 1, '2025-06-10 14:40:17', '2025-08-07 13:16:51'),
(39, 'Restrict unprivileged access to interfaces', 'Restrict access to interfaces that were previously accessible without special privileges, but turned out to be exploitable for side-channel attacks. Examples include unprivileged eBPF or the REPL interface.', NULL, NULL, 'SW', 'OS kernel', 'None', 0, 0, 1, 0, 0, NULL, NULL, 1, '2025-06-10 15:06:54', '2025-10-10 20:16:09'),
(40, 'Disable indirect branch prediction in privileged code', 'Disable the indirect branch predictor selectively, e.g., while in high-privilege mode', 'Hardware support to disable the indirect branch predictor', NULL, 'HW+SW', 'Branch predictor, OS kernel', 'None', 0, 0, 1, 0, 0, NULL, NULL, 1, '2025-06-10 15:30:01', '2025-10-10 20:17:50'),
(41, 'Clear BHB on privilege domain switch', 'Clear the Branch Target Buffer (BHB) on after a domain transition, for example with a dedicated instruction or a clearing instruction sequence.', 'CPU implementing vulnerable BHB, availability of a clearing instruction or reliable clearing instruction sequence', NULL, 'SW', 'OS kernel', 'None', 0, 1, 1, 0, 0, NULL, NULL, 1, '2025-06-11 09:21:05', '2025-08-07 13:16:51'),
(42, 'Intel Indirect Branch Predictor Controls', 'MSR IA32_SPEC_CTRL provides the following flags to control branch prediction:\n- BHI_DIS_S: prevents that branches in higher privilege levels are selected based on branch history in user space.\n- IPRED_DIS_U, IPRED_DIS_S: prevent transient execution at predicted targets of an indirect near JMP/CALL before the target is resolved. _U: prevents attacks within user mode, _S: prevents within supervisor mode (i.e., kernel)', 'Intel CPU supporting these features\n(from Alder Lake and Sapphire Rapids onwards [DOC45])', NULL, 'HW+SW', 'CPU, OS kernel', 'None', 1, 1, 1, 0, 0, NULL, NULL, 1, '2025-06-11 09:30:28', '2025-10-10 20:20:07'),
(43, 'Clear registers before return instruction', 'Zero out (or otherwise clear) used (or all) registers before a function returns.\r\nTypically a compiler mitigation.\r\nExample: gcc implements the -fzero-call-used-regs compiler flag.', NULL, NULL, 'SW', 'Compiler', 'None', 1, 0, 0, 0, 0, NULL, NULL, 1, '2025-06-11 14:08:09', '2025-08-07 13:16:51'),
(44, 'Disable branch prediction permanently', 'Disables branch prediction permanently.', 'CPU support (e.g., through MSR)', NULL, 'HW', 'CPU, Branch predictor', 'None', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-06-12 10:45:52', '2025-08-07 13:16:51'),
(45, 'Invalidate branch predictor state on context switch', 'Invalidate state of the branch predictor on a context switch within a privilege domain, for example through a specific instruction, instruction sequence, or other workaround.', 'Means of reliably invalidating the branch predictor', NULL, 'SW', 'OS kernel', 'None', 0, 1, 0, 0, 0, NULL, NULL, 1, '2025-06-12 10:50:11', '2025-08-07 13:16:51'),
(46, 'Arm-recommended compiler defense against Spectre-RSB', '1. Forbid callee-saved registers\r\n2. At return landing sites, perform the following steps in branchless logic:\r\n(a) compare PC and Link Register (which keeps the return address);\r\n(b) if unequal, clear frame and stack pointer', 'To be used by sandboxed programming languages when site isolation is not possible', NULL, 'SW', 'Compiler', 'None', 1, 0, 0, 0, 0, NULL, 'My guess is that PC != LR only happens in tranient execution when a misspeculation happened, which can then be trapped/made ineffective by clearing stack pointer and frame pointer.', 1, '2025-06-12 11:14:27', '2025-08-07 13:16:51'),
(47, 'Isolate kernel and user-space memory mappings (e.g., KPTI)', 'When in user space, only map those kernel addresses that really necessary instead of all kernel memory. The Linux implementation is known as \"Kernel Page-Table Isolation\" (KPTI), previously known as \"Kernel Address Isolation to have Side-channels Efficiently Removed\" (KAISER).', NULL, NULL, 'SW', 'OS kernel', 'None', NULL, NULL, NULL, NULL, NULL, NULL, NULL, 0, '2025-06-12 11:18:08', '2025-10-03 11:13:15'),
(48, 'Hardware fix (unspecified)', 'A hardware mitigation that is described only in very generic terms or not further explained/specified at all.', NULL, NULL, 'HW', 'CPU', 'None', NULL, NULL, NULL, NULL, NULL, NULL, NULL, 0, '2025-06-12 11:28:26', '2025-10-03 11:13:14'),
(49, 'Substitute sensitive register values before switch to lower privilege level', 'Put dummy values into registers that are security-sensitive before switching to a lower privilege level. This prevents attacks where a low-privilege attacker transiently reads those registers.', NULL, NULL, 'SW', 'OS kernel', 'None', NULL, NULL, NULL, NULL, NULL, NULL, NULL, 0, '2025-06-12 11:31:24', '2025-10-03 11:13:13'),
(50, 'Use Speculative Store Bypass Barriers', 'Barrier instructions that prevent any stores before the barrier from being bypassed by a speculative load after the barrier', 'Availability of such barriers', NULL, 'HW+SW', 'Compiler', 'None', 1, 0, 0, 0, 0, NULL, 'Assuming automated barrier placement by compilers', 1, '2025-06-12 11:53:45', '2025-08-07 13:16:51'),
(51, 'FEAT_ECBHB hardware fix', 'Feature FEAT_ECBHB \"requires that the branch history information created in a context before an exception to a higher exception level using AArch64 cannot be used by code before that exception to exploitatively control the execution of any code in a different context after the exception.\" [DOC39]', 'Arm CPU where ID_AA64MMFR1<63:60> = 0001', NULL, 'HW', 'CPU, Branch Predictor', 'None', 0, 0, 1, 0, 0, NULL, 'Arm does not specify implementation details.', 1, '2025-06-12 13:25:12', '2025-10-10 20:21:27'),
(53, 'Flush RSB on context switch', 'Flush the RSB on every (user-space) context switch to prevent mis-trained entries injected in one context to take effect in another.\r\nIdeally, this is implemented with hardware support for flushing. Alternatively, software sequences can be used to fill the RSB, which is more expensive and depends on implementation details (e.g., size of the RSB).', 'RSB flush instruction or knowledge of implementation details (size)', NULL, 'SW', 'OS kernel, scheduler', 'None', 0, 1, 0, 0, 0, NULL, NULL, 1, '2025-06-23 12:46:08', '2025-08-07 13:16:51'),
(54, 'Retpoline variant against Spectre-RSB', 'Replace ret instructions with a retpoline variant.\r\nThis retpoline pushes a harmless RSB entry (pointing to an endless loop that traps speculation) to the top of the RSB. When the ret is then executed, speculative execution is trapped in the endless loop while architectural control flow continues at the correct return address.\r\nHowever, this basically disables return address prediction and could thus be quite costly as a general countermeasure. [DOC41] proposes to only replace ret instructions in JIT-compiled code.', NULL, NULL, 'SW', '(JIT) compiler', 'None', 1, 1, 1, 1, 0, NULL, NULL, 1, '2025-06-23 12:50:58', '2025-08-07 13:16:51'),
(55, 'Speculative Load Hardening (SLH)', 'Truncate indices or pointers by introducing data dependencies. For example, in a classic Spectre-v1-scenario, repeat the conditional bounds check with a line like this in the branch:\n`index &= (index < size) ? ~0UL : 0;`\nAssume this line is implemented in branchless logic (e.g., with a conditional move). In that case, we introduce a data dependency on `index`, forcing its value to 0 in an out-of-bounds scenario (even in speculative execution). Specifically, we force the CPU to compute `index`, which is only possible when `size` is known. Because we use branchless logic, the branch predictor does not consider this a conditional it can predict, forcing the pipeline to stall until the computation can be finalized.\nSLH can be applied to a program automatically through a compiler pass.', 'Compiler support for SLH. ISA support for branchless conditional moves. No value prediction.', 'Specific to Spectre v1 (and sub-variants). Relies on the compiler detecting vulnerable branches.', 'SW', 'Compiler', 'None', 1, 1, 1, 1, 0, NULL, NULL, 1, '2025-06-27 15:37:01', '2025-10-10 20:23:38'),
(56, 'Store-to-Load Blocking (\"SLoth Bear\")', 'A hardware fix that prevents store-to-load forwarding either *from speculative stores* or *to speculative loads*. ', 'Microcode update or CPU implementing this feature', NULL, 'HW, MC', 'CPU pipeline', 'None', 1, 1, 1, 1, 0, NULL, 'Introduced as hypothetical defense in [DOC42]. The authors are unsure whether this can be implemented in microcode or if a hardware fix is necessary.', 1, '2025-06-27 15:37:01', '2025-08-07 13:16:51'),
(57, 'Lazy Store-to-Load Forwarding (\"SLoth\")', 'Compilers mark instructions that are candidates allowed to perform store-to-load forwarding. CPUs are modified to take those markings into account.', 'Microcode update or CPU implementing this feature', NULL, 'HW, MC', 'CPU pipeline, compiler', 'None', 1, 1, 1, 0, 0, NULL, 'Introduced as hypothetical defense in [DOC42]. There is very little detail.', 1, '2025-06-27 15:37:01', '2025-10-10 20:24:47'),
(58, 'Frozen Store-to-Load Forwarding (\"Arctic SLoth\")', 'A hardware fix that dynamically detects pairs of store and load instructions that are candidates for store-to-load forwarding. As an example, a history-based approach is proposed: Load instructions that previously required store-to-load forwarding on a correct (not mis-speculated) path are tracked and allowed to receive forwardings from any store instruction.', 'Microcode update or CPU implementing this feature', NULL, 'HW, MC', 'CPU pipeline', 'None', 1, 1, 1, 1, 0, NULL, 'Introduced as hypothetical defense in [DOC42]. Not sure if I understood this correctly, there is very little detail.', 1, '2025-06-27 15:37:01', '2025-08-07 13:16:52'),
(59, 'Intel BPI Microcode Update', 'In response to the BPI/BPRC disclosure, Intel released microcode patches that fixes the race condition.', 'Vulnerable Intel CPU', NULL, 'MC', 'Microcode', 'None', 1, 1, 1, 1, 0, NULL, NULL, 1, '2025-07-16 14:58:13', '2025-10-10 20:25:11'),
(60, 'Avoid indirect jumps (e.g., use JumpSwitches)', 'Idea of JumpSwitches: re-write indirect jumps to conditional direct jumps to prevent Spectre-v2 attacks. Note that these jump switches may then be vulernable to Spectre v1.\nMultiple JumpSwitch variants are proposed. The generic ones can be applied without requiring code changes, while the more advanced ones may require code changes.', NULL, NULL, 'SW', 'Compiler', 'None', 1, 1, 1, 1, 1, NULL, NULL, 1, '2025-07-16 15:15:49', '2025-10-09 10:50:32'),
(62, 'FineIBT', 'Software-based enhancement of CET-IBT [DEF38]. Before branching, the caller has to put a unique value into a register, which the callee checks. This further reduces the number of gadgets available to an attacker. ', 'CET-IBT-capable CPU, Compiler support', NULL, 'SW', 'Compiler', 'None', 1, 0, 0, 0, 0, NULL, NULL, 1, '2025-07-18 12:26:37', '2025-08-07 13:16:52'),
(63, 'Reptar Microcode Fix', 'A microcode fix to the Reptar bug [ATT22].', 'Vulnerable Intel CPU', NULL, 'MC', 'Microcode', 'None', 1, 1, 1, 1, 0, NULL, NULL, 1, '2025-08-05 09:26:45', '2025-08-18 07:35:17'),
(64, 'Disable SMT', 'Disable simultaneous multithreading (SMT, aka Hyper-Threading on Intel) to prevent cross-SMT attacks. These attacks are typically enabled by microarchitectural buffers that are shared between SMT threads.', 'SMT-capable CPU', NULL, 'HW+SW', 'Kernel', 'None', 0, 0, 0, 1, 0, NULL, NULL, 1, '2025-08-07 07:58:58', '2025-10-10 20:09:48'),
(65, 'Cache/State Partitioning along privilege levels', 'Partition a microarchitectural cache or state along process privilege levels, such as \"user space\" or \"kernel\"', NULL, NULL, 'HW+SW', 'Microarchitectural cache/state, OS kernel (protection domain assignment)', 'None', 0, 0, 1, 0, 0, NULL, NULL, 1, '2025-08-07 12:51:50', '2025-10-10 20:26:12'),
(66, 'Cache/State Partitioning along SMT threads', 'Partition a microarchitectural cache or state along SMT threads (thread IDs). (SMT = simultaneous multi-threading, aka Hyper-Threading on Intel)', NULL, NULL, 'HW+SW', 'Microarchitectural cache/state, OS kernel (protection domain assignment)', 'None', 0, 0, 0, 1, 0, NULL, NULL, 1, '2025-08-07 12:51:50', '2025-08-07 13:16:52'),
(67, 'Speculative Store Bypass Disable (SSBD)', 'A processor feature to mitigate speculative store bypass, aka Spectre v4. The feature is controlled through a bit in an MSR (Intel: IA32_SPEC_CTRL.SSBD). When the bit is set, the CPU enters a state where loads will not execute speculatively until the addresses of all older stores are known. This may impact performance. Therefore, this state should only be enabled selectively.', 'CPU affected by Spectre v4 and supporting SSBD', NULL, 'HW+SW', 'Processor, OS kernel', 'None', 1, 0, 0, 0, 0, NULL, NULL, 1, '2025-08-13 08:22:07', '2025-08-13 08:31:00');
-- --------------------------------------------------------
--
-- Table structure for table `defense_implementations`
--
CREATE TABLE `defense_implementations` (
`id` int(11) NOT NULL,
`defense_id` int(11) NOT NULL,
`name` text NOT NULL,
`maturity` varchar(128) NOT NULL,
`requirements` text DEFAULT NULL,
`constraints` text DEFAULT NULL,
`open_source` tinyint(1) NOT NULL,
`url` text DEFAULT NULL,
`comment` text DEFAULT NULL,
`ready` tinyint(1) NOT NULL DEFAULT 0,
`created` timestamp NOT NULL DEFAULT current_timestamp(),
`updated` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci;
--
-- Dumping data for table `defense_implementations`
--
INSERT INTO `defense_implementations` (`id`, `defense_id`, `name`, `maturity`, `requirements`, `constraints`, `open_source`, `url`, `comment`, `ready`, `created`, `updated`) VALUES
(1, 1, 'PreFence prototype', 'Public research prototype', 'Linux, Intel \"classic\" prefetchers, ARM A72 prefetchers, Linux', 'Non-trivial annotations for DMPs.', 1, 'https://github.com/scy-phy/PreFence', NULL, 1, '2025-05-14 15:27:30', '2025-06-11 10:49:23'),
(2, 7, 'Raccoon prototype', 'Private research prototype', NULL, NULL, 0, NULL, NULL, 1, '2025-05-26 14:04:14', '2025-10-02 11:03:29'),
(3, 9, 'clear-ip-prefetcher instruction (to be called on context switches)', 'Private research prototype', NULL, 'Only simulation, not implemented on real hardware', 0, NULL, 'Evaluated in ChampSim on SPEC benchmarks. ', 1, '2025-05-26 14:44:56', '2025-10-09 11:29:43'),
(4, 26, 'Intel IBRS/eIBRS implementation', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-06-02 11:57:21', '2025-06-02 11:57:21'),
(5, 8, 'WebKit: Reduced timer precision', 'Implemented', NULL, NULL, 1, NULL, 'Implemented against spectre', 1, '2025-06-02 12:16:00', '2025-06-02 12:19:49'),
(6, 23, 'WebKit: Index masking', 'Implemented', NULL, NULL, 1, NULL, NULL, 1, '2025-06-02 12:17:07', '2025-06-02 12:19:31'),
(7, 24, 'WebKit: Pointer poisoning', 'Implemented', NULL, NULL, 1, NULL, NULL, 1, '2025-06-02 12:18:49', '2025-06-02 12:19:48'),
(8, 14, 'Chromium: Site Isolation', 'Implemented', NULL, NULL, 1, 'https://www.chromium.org/Home/chromium-security/site-isolation/', NULL, 1, '2025-06-02 12:24:43', '2025-06-02 12:24:43'),
(9, 8, 'Microsoft Edge, Internet Explorer: Reduced timer precision', 'Implemented', NULL, NULL, 0, NULL, 'Removing support for SharedArrayBuffer, reducing the resolution of performance.now()', 1, '2025-06-02 12:35:45', '2025-06-02 12:55:16'),
(10, 8, 'Mozilla Firefox: Reduced timer precision', 'Implemented', NULL, NULL, 1, NULL, 'Removing support for SharedArrayBuffer, reducing the resolution of performance.now()', 1, '2025-06-02 12:49:51', '2025-06-02 12:55:01'),
(11, 28, 'Intel STIBP implementation', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-06-02 13:02:02', '2025-06-11 07:49:33'),
(12, 27, 'Intel IBPB implementation', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-06-02 13:02:02', '2025-06-11 07:49:41'),
(13, 26, 'AMD IBRS/AutoIBRS implementation', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-06-02 13:04:06', '2025-06-11 07:50:00'),
(14, 27, 'AMD IBPB implementation', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-06-02 13:04:06', '2025-07-14 08:03:13'),
(15, 28, 'AMD STIBP implementation', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-06-02 13:04:06', '2025-06-11 07:50:17'),
(16, 22, 'MSVC: Inserting barriers against Spectre v1 automatically (x86 and ARM)', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-06-02 13:14:24', '2025-06-02 13:25:04'),
(17, 29, 'LLVM retpoline implementation', 'Implemented', NULL, NULL, 1, 'https://reviews.llvm.org/D41723', NULL, 1, '2025-06-03 13:31:41', '2025-06-03 13:31:41'),
(18, 29, 'GCC retpoline implementation', 'Implemented', NULL, NULL, 1, 'https://web.archive.org/web/20190611185026if_/https://git.infradead.org/users/dwmw2/gcc-retpoline.git/shortlog/refs/heads/gcc-7_2_0-retpoline-20171219', NULL, 1, '2025-06-03 13:31:41', '2025-06-03 13:31:41'),
(19, 30, 'Conditional RSB refill linux kernel patch', 'Implemented', 'Retbleed-vulnerable Intel CPU', NULL, 1, 'https://lore.kernel.org/lkml/Y5mplIDz1VX7DMhG@zn.tnic/', 'Merged into Linux 6.2', 1, '2025-06-04 13:17:12', '2025-06-05 08:16:50'),
(20, 37, 'Arm SMCCC_ARCH_WORKAROUND_1', 'Implemented', 'SMC available on the target CPU', NULL, 1, 'https://developer.arm.com/documentation/110280/latest', 'Secure Monitor Call that can be called from lower privilege levels to clear the branch predictor\'s state on some Arm CPUs. Open-source implementation in Trusted Firmware: https://github.com/ARM-software/arm-trusted-firmware/pull/1240', 1, '2025-06-10 14:30:49', '2025-10-09 13:15:52'),
(21, 6, 'Arm FEAT_CSV2', 'Implemented', 'CPU supports FEAT_CSV2 (check MSR ID_AA64PFR0_EL1.CSV2)', NULL, 0, 'https://documentation-service.arm.com/static/623c60d13b9f553dde8fd8e6', 'Separates branch predictor state per context. There are different versions. CSV2=1 only separates along hardware contexts, CSV2=2 also separates along software-defined contexts (SCXTNUM_ELx registers).\n\nActual security guarantees are unclear, since Arm specifies \"Branch targets and branch history trained in one hardware-described context can exploitatively control speculative execution in a different hardware-described context only in a hard-to-determine way\" [DOC39].', 1, '2025-06-10 14:35:28', '2025-07-15 12:03:07'),
(22, 39, 'Linux kernel: Disallow unprivileged eBPF by default', 'Implemented', NULL, NULL, 1, 'https://lore.kernel.org/bpf/20211027233943.kehyrdbibp2d2u4c@gupta-dev2.localdomain/T/', NULL, 1, '2025-06-10 15:21:37', '2025-06-10 15:21:37'),
(23, 38, 'Intel CET-IBT Implementation', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-06-10 15:25:14', '2025-06-10 15:25:14'),
(24, 42, 'Intel Indirect Branch Predictor Controls Implementation', 'Implemented', NULL, NULL, 0, 'https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html', NULL, 1, '2025-06-11 10:45:42', '2025-06-11 14:45:19'),
(25, 29, 'Linux Kernel Retpolines', 'Implemented', NULL, NULL, 1, 'https://docs.kernel.org/admin-guide/hw-vuln/spectre.html#id2', NULL, 1, '2025-06-11 13:51:10', '2025-06-11 13:51:10'),
(26, 43, 'GCC -fzero-call-used-regs flag', 'Implemented', NULL, NULL, 1, 'https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-fzero-call-used-regs', NULL, 1, '2025-06-11 14:09:38', '2025-06-11 14:09:38'),
(28, 47, 'Kernel Page-Table Isolation (KPTI, PTI, KAISER)', 'Implemented', NULL, NULL, 1, 'https://www.kernel.org/doc/html/next/x86/pti.html', 'KPTI is the name of the implementation of this defense in the Linux kernel. Also known as Page-Table Isolation (PTI). Previously known as KAISER.', 1, '2025-06-12 11:21:49', '2025-06-12 11:21:49'),
(29, 50, 'Arm SSBB/PSSBB instructions', 'Implemented', NULL, NULL, 0, 'https://developer.arm.com/documentation/ddi0597/2025-03/Base-Instructions/SSBB--Speculative-Store-Bypass-Barrier-', 'SSBB for virtual addresses, PSSBB for physical addresses', 1, '2025-06-12 11:55:28', '2025-06-12 11:55:28'),
(30, 41, 'Arm CLRBHB instruction', 'Implemented', 'Arm CPU that supports the CLRBHB instruction', NULL, 0, NULL, 'Newly introduced instruction to clear the BHB on selected Arm CPUs', 1, '2025-06-12 13:16:38', '2025-10-09 13:15:43'),
(31, 51, 'Arm FEAT_ECBHB', 'Implemented', 'Arm CPU where ID_AA64MMFR1<63:60> = 0001', NULL, 0, NULL, NULL, 1, '2025-06-12 13:20:32', '2025-10-09 13:38:54'),
(32, 55, 'LLVM Speculative Load Hardening Implementation', 'Implemented', NULL, NULL, 1, 'https://llvm.org/docs/SpeculativeLoadHardening.html', NULL, 1, '2025-07-14 13:16:24', '2025-10-11 20:12:38'),
(39, 32, 'Intel SMEP implementation', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-07-14 14:44:24', '2025-07-14 14:44:24'),
(40, 33, 'Intel SMAP implementation', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-07-14 14:44:24', '2025-07-14 14:44:24'),
(41, 32, 'AMD SMEP implementation', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-07-14 14:44:24', '2025-10-09 11:54:00'),
(42, 33, 'AMD SMAP implementation', 'Implemented', NULL, NULL, 0, NULL, NULL, 1, '2025-07-14 14:44:24', '2025-10-09 11:53:58'),
(43, 32, 'Arm PXN implementation', 'Implemented', NULL, NULL, 0, 'https://developer.arm.com/documentation/102376/0100/Permissions-attributes', NULL, 0, '2025-07-14 14:44:24', '2025-10-09 13:15:49'),
(44, 33, 'Arm PAN implementation', 'Implemented', NULL, NULL, 0, 'https://developer.arm.com/documentation/102376/0100/Permissions-attributes', NULL, 0, '2025-07-14 14:44:24', '2025-10-09 13:15:46'),
(45, 59, 'Intel BPI Microcode Update', 'Implemented', 'Vulnerable Intel CPU', NULL, 0, 'https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01247.html', NULL, 1, '2025-07-16 14:58:43', '2025-07-16 14:58:43'),
(46, 60, 'JumpSwitch Implementation', 'Private research prototype', NULL, NULL, 0, NULL, 'The researchers apparently implemented their proposal, but I could not find a public version of it.', 1, '2025-07-17 10:54:27', '2025-10-02 11:03:49'),
(47, 62, 'FineIBT Artifact Implementation', 'Public research prototype', NULL, NULL, 1, 'https://gitlab.com/brown-ssl/fineibt', NULL, 1, '2025-07-18 13:22:20', '2025-10-02 11:03:54'),
(48, 62, 'FineIBT in Linux Kernel', 'Implemented', NULL, NULL, 1, 'https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?h=x86/core&id=931ab63664f02b17d2213ef36b83e1e50190a0aa', NULL, 1, '2025-07-18 13:22:20', '2025-07-18 13:22:20'),
(49, 63, 'Reptar Microcode Fix Implementation', 'Implemented', 'Vulnerable Intel CPU', NULL, 0, 'https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html', NULL, 1, '2025-08-05 09:28:01', '2025-08-05 10:34:19'),
(50, 64, 'Linux SMT disable feature (nosmt)', 'Implemented', NULL, NULL, 1, 'https://docs.kernel.org/admin-guide/kernel-parameters.html', 'The Linux kernel can be instructed to disable SMT, for example through the kernel command line parameter `nosmt`. Effectively, the kernel then just takes offline all but the primary logical core per physical core (see https://elixir.bootlin.com/linux/v6.16/source/kernel/cpu.c#L2662).', 0, '2025-08-07 08:08:42', '2025-10-09 11:52:22'),
(51, 67, 'Linux Kernel SSBD implementation', 'Implemented', NULL, NULL, 1, 'https://man7.org/linux/man-pages/man2/PR_SET_SPECULATION_CTRL.2const.html', 'The Linux kernel provides access to the SSBD bit to user-space processes through the prctl() system call, allowing to set the bit per program thread.', 1, '2025-08-13 08:22:13', '2025-08-13 08:22:22');
-- --------------------------------------------------------
--
-- Table structure for table `defense_mitigates_attack`
--
CREATE TABLE `defense_mitigates_attack` (
`id` int(11) NOT NULL,
`defense_id` int(11) NOT NULL,
`attack_id` int(11) NOT NULL,
`limitations` text DEFAULT NULL,
`comment` text DEFAULT NULL,
`created` timestamp NOT NULL DEFAULT current_timestamp(),
`updated` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci;
--
-- Dumping data for table `defense_mitigates_attack`
--
INSERT INTO `defense_mitigates_attack` (`id`, `defense_id`, `attack_id`, `limitations`, `comment`, `created`, `updated`) VALUES
(1, 1, 1, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:08:54'),
(2, 3, 1, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 09:44:28'),
(3, 4, 1, 'Only complete for address-based prefetchers', NULL, '2025-06-02 13:27:27', '2025-08-06 09:44:33'),
(4, 5, 1, 'Only complete if shared memory is shared library', NULL, '2025-06-02 13:27:27', '2025-08-06 09:44:41'),
(5, 3, 3, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 12:08:53'),
(6, 6, 3, NULL, 'Referring to the prefetcher\'s state', '2025-06-02 13:27:27', '2025-08-07 12:59:06'),
(7, 4, 3, 'Only complete for address-based prefetchers', NULL, '2025-06-02 13:27:27', '2025-08-06 12:11:36'),
(8, 7, 3, 'Might be incomplete for DMPs: the GoFetch strategy of causing oberservable intermediate values might still work.', NULL, '2025-06-02 13:27:27', '2025-08-06 12:11:42'),
(9, 8, 3, 'Incomplete. Almost impossible to deny access to all precise timing sources.', NULL, '2025-06-02 13:27:27', '2025-08-06 13:41:49'),
(10, 9, 3, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 14:32:11'),
(11, 10, 3, 'Defending against DMPs would require prohibitively wide-spread/complex use of such an instruction.', NULL, '2025-06-02 13:27:27', '2025-08-06 12:12:06'),
(12, 11, 3, 'Only reduces the attack surface. For example, instruction addresses in shared libraries are fully shared between processes. Thus, processes can still perform aliasing with full addresses. ', NULL, '2025-06-02 13:27:27', '2025-08-06 12:12:12'),
(13, 3, 4, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 12:15:30'),
(14, 6, 4, NULL, 'Referring to the prefetcher\'s state', '2025-06-02 13:27:27', '2025-08-07 12:59:08'),
(15, 7, 5, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 12:21:13'),
(16, 12, 6, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 12:40:52'),
(17, 14, 6, 'Incomplete, the GoFetch paper [DOC14] later introduced a Prime+Probe-based eviction mechanism that overcomes address space separation.', NULL, '2025-06-02 13:27:27', '2025-08-07 12:34:20'),
(18, 15, 6, 'Risky and likely incomplete in practice. Relying on implementation details (like: which memory regions the prefetcher does not operate in, which address bits the prefetcher ignores) is not a general defense (it is bound to a specific CPU model), assumes that all implementation details are fully known, and may be invalidated through updates to the prefetcher implementation at any time without notice.', NULL, '2025-06-02 13:27:27', '2025-08-06 12:45:09'),
(19, 16, 6, 'Incomplete. Later papers (e.g. GoFetch [DOC14]) showed that the Apple DMP may be triggered by just a single load, which can hardly be avoided in source code.', NULL, '2025-06-02 13:27:27', '2025-08-06 12:46:55'),
(20, 3, 6, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 12:30:09'),
(22, 17, 6, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 12:47:27'),
(23, 13, 6, NULL, 'Does not address the root cause', '2025-06-02 13:27:27', '2025-08-06 12:50:11'),
(24, 1, 6, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:11:56'),
(25, 18, 6, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 12:50:51'),
(27, 1, 3, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:11:59'),
(29, 1, 4, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:08:49'),
(30, 6, 9, NULL, 'Referring to the prefetcher\'s state', '2025-06-02 13:27:27', '2025-08-07 12:59:00'),
(31, 6, 7, NULL, 'Referring to the prefetcher\'s state', '2025-06-02 13:27:27', '2025-08-07 12:59:02'),
(32, 9, 9, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 14:32:29'),
(33, 9, 7, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 14:32:31'),
(34, 20, 9, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:34:31'),
(35, 20, 7, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:36:54'),
(36, 3, 9, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:11:26'),
(37, 3, 7, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 12:52:46'),
(38, 19, 9, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:36:50'),
(39, 19, 7, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:37:03'),
(40, 4, 9, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:38:33'),
(42, 21, 10, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:40:21'),
(43, 21, 11, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:40:19'),
(44, 21, 12, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:40:17'),
(45, 22, 10, NULL, 'On ARM: CSDB barrier or DSB SYS + ISB [DOC38]\nComplete in theory (if used consequently and all vulnerable gadgets are found)', '2025-06-02 13:27:27', '2025-10-02 10:53:09'),
(46, 22, 11, NULL, 'Complete in theory (if used consequently and all vulnerable gadgets are found)', '2025-06-02 13:27:27', '2025-10-02 10:53:03'),
(47, 14, 10, NULL, NULL, '2025-06-02 13:27:27', '2025-08-07 12:34:17'),
(48, 23, 10, 'Incomplete: (1) Only applicable to misspeculated bounds checks, (2) If array length is not a power of 2, subsequent out-of-bounds data can still be leaked up to the next power of 2.', NULL, '2025-06-02 13:27:27', '2025-08-06 13:56:39'),
(49, 24, 10, 'Incomplete: only protects pointers', NULL, '2025-06-02 13:27:27', '2025-08-06 13:57:18'),
(50, 25, 10, NULL, NULL, '2025-06-02 13:27:27', '2025-08-06 13:58:40'),
(51, 8, 10, 'Incomplete. Almost impossible to deny access to all precise timing sources.', NULL, '2025-06-02 13:27:27', '2025-08-06 13:42:43'),
(52, 8, 11, 'Incomplete. Almost impossible to deny access to all precise timing sources.', NULL, '2025-06-02 13:27:27', '2025-08-06 13:42:41'),
(53, 26, 11, 'BPI (Branch Privilege Injection) [DOC47] showed that eIBRS can be bypassed on some Intel CPUs with a race condition.', NULL, '2025-06-02 13:27:27', '2025-08-06 14:37:34'),
(54, 28, 11, NULL, NULL, '2025-06-02 13:27:27', '2025-08-07 13:10:34'),
(55, 27, 11, NULL, NULL, '2025-06-02 13:27:27', '2025-08-07 12:32:51'),
(56, 29, 11, 'Initially considered complete, then pointed out to be incomplete through retbleed [DOC30]', NULL, '2025-06-02 13:27:27', '2025-08-07 09:23:11'),
(63, 8, 13, 'Incomplete. Almost impossible to deny access to all precise timing sources.', NULL, '2025-06-03 09:26:56', '2025-08-06 13:42:40'),
(64, 8, 12, 'Incomplete. Almost impossible to deny access to all precise timing sources.', NULL, '2025-06-03 11:23:03', '2025-08-06 13:42:39'),
(65, 14, 12, NULL, NULL, '2025-06-03 11:26:25', '2025-08-06 15:07:57'),
(66, 30, 14, NULL, NULL, '2025-06-04 13:17:48', '2025-08-07 12:14:04'),
(67, 31, 15, NULL, 'Incomplete on its own. Has to be combined with STIBP to prevent attacks from sibling SMT threads. On CPUs without STIBP support, SMT needs to be disabled.', '2025-06-04 13:23:52', '2025-08-18 07:49:47'),
(68, 26, 14, NULL, NULL, '2025-06-04 13:27:02', '2025-08-07 07:38:11'),
(69, 33, 10, 'Incomplete, only prevents transient accesses to user-mode pages in kernel, but leaves kernel memory at risk.', NULL, '2025-06-04 15:44:22', '2025-08-06 14:00:14'),
(70, 32, 10, 'Incomplete, only prevents transient code execution from user-mode pages in kernel, i.e., only reduces number of available gadgets.', NULL, '2025-06-04 15:44:22', '2025-08-06 14:00:54'),
(71, 33, 11, 'Incomplete, only prevents transient accesses to user-mode pages in kernel, but leaves kernel memory at risk.', NULL, '2025-06-04 15:44:57', '2025-08-06 14:08:14'),
(72, 32, 11, 'Incomplete, only prevents transient code execution from user-mode pages in kernel, i.e., only reduces number of available gadgets.', NULL, '2025-06-04 15:44:57', '2025-08-06 14:08:16'),
(73, 34, 11, 'Incomplete, only prevents RSB-based predictions', NULL, '2025-06-04 16:06:44', '2025-08-07 10:30:06'),
(74, 35, 10, NULL, 'Complete in theory (if used consequently and all vulnerable gadgets are found)', '2025-06-04 16:13:36', '2025-10-02 10:53:00'),
(75, 36, 11, 'Found to be incomplete on some AMD processors.', NULL, '2025-06-06 10:08:44', '2025-08-06 14:36:41'),
(76, 29, 16, 'Incomplete (due to retbleed)', NULL, '2025-06-10 14:41:57', '2025-08-07 09:23:13'),
(77, 37, 11, NULL, NULL, '2025-06-10 14:49:08', '2025-08-07 10:25:49'),
(78, 27, 16, NULL, 'Incomplete on its own, has to be combined with disabling SMT [DOC36, Section 7]', '2025-06-10 14:57:31', '2025-08-18 07:57:32'),
(79, 26, 16, 'Complete on AMD (for cross-domain attacks). According to the BHI paper [DOC36], IBRS is incomplete on Intel, while Intel claims it mitigates Spectre-BHB [DOC33], [DOC35].', NULL, '2025-06-10 14:59:45', '2025-08-07 12:33:48'),
(80, 39, 16, 'Incomplete, only prevents a specific case study attack', 'Concrete proposal: restrict unprivileged access to eBPF', '2025-06-10 15:07:41', '2025-08-07 08:44:55'),
(81, 38, 16, 'Incomplete, only reduces the number of available gadgets, and leaves residual speculation window (especially on older Intel CPUs)', NULL, '2025-06-10 15:24:15', '2025-08-07 08:46:18'),
(82, 40, 16, NULL, NULL, '2025-06-10 15:30:46', '2025-08-07 08:52:10'),
(83, 32, 16, 'Incomplete, only prevents transient code execution from user-mode pages in kernel, i.e., only reduces number of available gadgets.', NULL, '2025-06-11 08:44:49', '2025-08-07 10:31:30'),
(84, 22, 16, NULL, 'Complete in theory (if used consequently and all vulnerable gadgets are found)', '2025-06-11 08:51:27', '2025-10-02 10:52:56'),
(85, 41, 16, NULL, 'Probably incomplete on its own and needs to be combined with disabling SMT', '2025-06-11 09:23:05', '2025-08-18 07:57:04'),
(86, 42, 16, NULL, NULL, '2025-06-11 09:31:51', '2025-08-07 09:10:06'),
(87, 43, 16, 'Incomplete, only makes gadgets harder to use.', NULL, '2025-06-11 14:19:03', '2025-08-07 09:14:40'),
(88, 22, 17, NULL, 'Complete in theory (if used consequently and all vulnerable gadgets are found)', '2025-06-12 10:35:04', '2025-10-02 10:52:53'),
(89, 44, 11, NULL, NULL, '2025-06-12 10:46:25', '2025-08-06 14:04:25'),
(90, 44, 18, NULL, NULL, '2025-06-12 10:46:25', '2025-08-07 12:14:09'),
(91, 45, 11, NULL, NULL, '2025-06-12 10:52:37', '2025-08-06 14:37:05'),
(92, 45, 18, NULL, NULL, '2025-06-12 10:52:37', '2025-08-07 10:23:27'),
(93, 37, 18, NULL, NULL, '2025-06-12 10:54:47', '2025-08-07 10:24:38'),
(94, 14, 18, NULL, 'At least on Intel, cross-process attacks are still possible [DOC40], [DOC41]. Maybe complete on ARM?\nMainly refers to site isolation in browsers in [DOC38], [DOC41]', '2025-06-12 11:09:12', '2025-08-18 07:56:34'),
(95, 46, 18, NULL, NULL, '2025-06-12 11:15:01', '2025-08-07 10:29:25'),
(96, 47, 13, NULL, NULL, '2025-06-12 11:22:38', '2025-08-07 12:13:02'),
(97, 48, 19, NULL, NULL, '2025-06-12 11:28:48', '2025-08-07 12:13:03'),
(98, 49, 19, NULL, NULL, '2025-06-12 11:31:46', '2025-08-18 07:56:16'),
(99, 50, 12, NULL, 'Complete in theory (if used consequently and all vulnerable code instances are found)', '2025-06-12 11:58:28', '2025-10-02 10:52:49'),
(100, 51, 16, NULL, NULL, '2025-06-12 13:22:30', '2025-08-07 09:14:48'),
(101, 6, 16, NULL, 'Referring to the BHB, and in particular, FEAT_CSV2 on Arm', '2025-06-12 13:47:04', '2025-08-07 12:58:02'),
(102, 34, 18, NULL, NULL, '2025-06-20 14:58:51', '2025-08-07 10:30:08'),
(103, 32, 18, 'Incomplete, only prevents transient code execution from user-mode pages in kernel, i.e., only reduces number of available gadgets.', 'For Spectre-RSB attacks from userspace to kernel, SMEP prevents that a return gadget in user space can be called. The attacker must use a gadget in kernel space.', '2025-06-20 15:00:46', '2025-08-07 10:31:38'),
(109, 21, 18, NULL, NULL, '2025-06-23 12:40:15', '2025-08-06 13:40:23'),
(110, 25, 18, NULL, NULL, '2025-06-23 12:40:15', '2025-08-07 10:32:15'),
(111, 22, 18, NULL, 'Place serializing instruction after every call instruction.\nComplete in theory (if used consequently and all vulnerable gadgets are found)', '2025-06-23 12:40:15', '2025-10-02 10:52:46'),
(112, 8, 18, 'Incomplete. Almost impossible to deny access to all precise timing sources.', 'Proposed as browser-based defense to avoid sandbox-escaping attacks', '2025-06-23 12:40:15', '2025-08-06 13:42:39'),
(113, 53, 18, NULL, NULL, '2025-06-23 12:51:48', '2025-08-07 11:31:00'),
(114, 54, 18, NULL, NULL, '2025-06-23 12:51:48', '2025-08-07 11:31:02'),
(115, 48, 20, NULL, 'Idea: CPU vendors should ensure that speculative store data is only forwarded to dependent loads when page table entries (e.g., in TLB) have been checked and confirm write access.', '2025-06-27 15:01:21', '2025-08-07 12:13:14'),
(123, 55, 17, 'Incomplete, only prevents attacks through patterns that the compiler detects and re-writes', NULL, '2025-06-27 15:42:55', '2025-08-07 09:19:18'),
(124, 56, 17, NULL, NULL, '2025-06-27 15:42:55', '2025-08-07 09:22:09'),
(125, 57, 17, NULL, 'Unfortunately, there is very little information and detail to be found about this defense.', '2025-06-27 15:42:55', '2025-08-07 09:21:46'),
(126, 58, 17, NULL, 'Unfortunately, there is very little information and detail to be found about this defense.', '2025-06-27 15:42:55', '2025-08-07 09:22:24'),
(127, 23, 17, 'Incomplete: (1) Only applicable to misspeculated bounds checks, (2) If array length is not a power of 2, subsequent out-of-bounds data can still be leaked up to the next power of 2.', NULL, '2025-06-27 15:42:55', '2025-08-06 13:58:18'),
(128, 55, 20, 'Incomplete, only prevents attacks through patterns that the compiler detects and re-writes', NULL, '2025-07-14 13:18:19', '2025-08-07 12:13:21'),
(129, 55, 10, 'Incomplete, only prevents attacks through patterns that the compiler detects and re-writes', NULL, '2025-07-14 13:18:19', '2025-08-07 12:24:55'),
(131, 29, 20, NULL, NULL, '2025-07-14 13:21:30', '2025-08-07 12:13:44'),
(132, 59, 21, NULL, NULL, '2025-07-16 14:59:36', '2025-08-07 12:12:00'),
(133, 29, 21, NULL, 'Complete only in combination with RRSBA_DIS_S', '2025-07-16 15:06:15', '2025-08-18 07:55:24'),
(134, 42, 21, NULL, 'Only prevents attacks on supervisor mode (i.e., kernel space). The especially relevant control for this attack is IPRED_DIS_S.', '2025-07-16 15:08:13', '2025-08-18 07:55:09'),
(135, 60, 21, NULL, 'Assuming there are no analogous vulnerabilities in branch prediction logic for direct branches', '2025-07-16 15:17:04', '2025-08-07 12:09:13'),
(136, 60, 11, NULL, 'The proposed JumpSwitch architecture includes a fallback to retpolines when JumpSwitch cannot learn the jump targets', '2025-07-17 10:57:14', '2025-08-06 14:39:16'),
(137, 38, 11, 'Incomplete, only reduces the number of available gadgets', NULL, '2025-07-17 11:13:26', '2025-08-06 14:40:16'),
(138, 62, 16, 'Incomplete, only makes attacks harder (only reduces the number of available gadgets, leaves some residual speculation potential, which is exploitable as [DOC45] shows).', NULL, '2025-07-18 12:28:24', '2025-08-13 09:30:34'),
(139, 63, 22, NULL, NULL, '2025-08-05 10:33:29', '2025-08-07 12:12:52'),
(140, 64, 15, NULL, 'Required on AMD CPUs where STIBP is not supported (such as Zen 1+), i.e., no separation of the vulnerable buffers per SMT core can be configured, to prevent cross-SMT attacks.', '2025-08-07 08:11:03', '2025-08-07 08:11:38'),
(141, 28, 15, NULL, 'If available, STIBP prevents cross-SMT attacks. If unavailable, SMT should be disabled.', '2025-08-07 08:12:49', '2025-08-07 08:12:49'),
(142, 64, 16, NULL, 'Incomplete on its own, has to be combined with IBPB on privilege level switch', '2025-08-07 08:49:30', '2025-08-18 07:54:18'),
(143, 66, 4, NULL, 'Referring to the prefetcher\'s state', '2025-08-07 12:54:30', '2025-08-07 12:59:54'),
(144, 65, 3, NULL, 'Referring to the prefetcher\'s state', '2025-08-07 12:54:30', '2025-08-07 12:58:22'),
(145, 67, 12, NULL, NULL, '2025-08-13 08:27:24', '2025-08-13 08:27:24'),
(146, 22, 12, NULL, 'Complete in theory (if used consequently and all vulnerable gadgets are found)', '2025-08-13 08:28:27', '2025-10-02 10:52:37'),
(147, 62, 11, 'Incomplete, only makes attacks harder (only reduces the number of available gadgets, leaves some residual speculation potential, which is exploitable as [DOC45] shows).', NULL, '2025-08-13 09:31:10', '2025-08-13 09:31:24');
-- --------------------------------------------------------
--
-- Table structure for table `defense_mitigates_attack_references`
--
CREATE TABLE `defense_mitigates_attack_references` (
`id` int(11) NOT NULL,
`dma_id` int(11) NOT NULL COMMENT 'ID in "defense_mitigates_attack"',
`document_id` int(11) NOT NULL,
`section` varchar(128) DEFAULT NULL,
`disputes` tinyint(1) NOT NULL DEFAULT 0 COMMENT 'Set to 1 if the referenced document disputes that the defense mitigates the attack',
`created` timestamp NOT NULL DEFAULT current_timestamp(),
`updated` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci;
--
-- Dumping data for table `defense_mitigates_attack_references`
--
INSERT INTO `defense_mitigates_attack_references` (`id`, `dma_id`, `document_id`, `section`, `disputes`, `created`, `updated`) VALUES
(61, 1, 1, NULL, 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(62, 2, 2, 'Section 6.4', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(63, 3, 2, 'Section 6.4', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(64, 4, 2, 'Section 6.4', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(65, 5, 10, 'Section 8.2', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(66, 6, 10, 'Section 8.2', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(67, 7, 10, 'Section 8.2', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(68, 8, 10, 'Section 8.2', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(69, 9, 10, 'Section 8.2', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(70, 10, 10, 'Section 8.3', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(73, 13, 12, 'Section IX', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(74, 14, 12, 'Section IX', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(75, 15, 15, 'Section 1', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(76, 16, 13, 'Section VIII', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(77, 17, 13, 'Section VIII.A, Section VIII.D', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(78, 18, 13, 'Section VIII.B, Section VIII.C', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(79, 19, 13, 'Section VIII.D', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(80, 20, 14, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(81, 16, 14, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(82, 22, 14, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(83, 23, 14, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(84, 24, 14, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(85, 25, 14, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(86, 24, 1, 'Section 5', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(87, 27, 1, 'Section 5', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(88, 29, 1, 'Section 5', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(89, 30, 16, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(90, 31, 16, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(91, 32, 16, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(92, 33, 16, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(93, 34, 16, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(94, 35, 16, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(95, 36, 16, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(96, 37, 16, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(97, 38, 16, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(98, 39, 16, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(99, 40, 16, 'Section 8', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(101, 42, 4, 'Section VII.A', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(102, 43, 4, 'Section VII.A', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(103, 44, 4, 'Section VII.A', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(104, 45, 4, 'Section VII.A', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(105, 46, 4, 'Section VII.A', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(106, 47, 4, 'Section VII.B', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(107, 48, 4, 'Section VII.B', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(108, 49, 4, 'Section VII.B', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(109, 50, 4, 'Section VII.C', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(110, 51, 4, 'Section VII.D', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(111, 52, 4, 'Section VII.D', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(112, 53, 4, 'Section VII.E', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(113, 54, 4, 'Section VII.E', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(114, 55, 4, 'Section VII.E', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(115, 56, 4, 'Section VII.E', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(116, 51, 19, 'Reducing Timer Precision', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(117, 48, 19, 'Index Masking', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(118, 49, 19, 'Pointer Poisoning', 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(119, 53, 17, NULL, 0, '2025-06-02 11:27:27', '2025-06-03 08:04:29'),
(121, 51, 28, NULL, 0, '2025-06-03 09:28:27', '2025-06-03 09:28:27'),
(122, 52, 28, NULL, 0, '2025-06-03 09:28:27', '2025-06-03 09:28:27'),
(123, 63, 28, NULL, 0, '2025-06-03 09:28:27', '2025-06-03 09:28:27'),
(124, 45, 29, NULL, 0, '2025-06-03 09:29:45', '2025-06-03 09:29:45'),
(125, 51, 25, NULL, 0, '2025-06-03 09:30:49', '2025-06-03 09:30:49'),
(126, 52, 25, NULL, 0, '2025-06-03 09:30:49', '2025-06-03 09:30:49'),
(127, 63, 25, NULL, 0, '2025-06-03 09:30:49', '2025-06-03 09:30:49'),
(128, 27, 11, 'Section 7', 0, '2025-06-03 09:37:38', '2025-06-03 09:37:38'),
(129, 12, 11, 'Section 7', 0, '2025-06-03 09:37:38', '2025-06-03 09:37:38'),
(130, 5, 11, 'Section 7', 0, '2025-06-03 09:37:38', '2025-06-03 09:37:38'),
(131, 7, 11, 'Section 7', 0, '2025-06-03 09:37:38', '2025-06-03 09:37:38'),
(132, 6, 11, 'Section 7', 0, '2025-06-03 09:37:38', '2025-06-03 09:37:38'),
(133, 10, 11, 'Section 7', 0, '2025-06-03 09:37:38', '2025-06-03 09:37:38'),
(134, 11, 11, 'Section 7', 0, '2025-06-03 09:37:38', '2025-06-03 09:37:38'),
(135, 64, 4, 'Section VII.D', 0, '2025-06-03 11:23:31', '2025-06-03 11:23:31'),
(136, 65, 4, 'Section VII.B', 0, '2025-06-03 11:27:14', '2025-06-03 11:27:14'),
(137, 47, 24, NULL, 0, '2025-06-03 13:17:59', '2025-06-03 13:17:59'),
(138, 56, 22, NULL, 0, '2025-06-03 13:25:25', '2025-06-03 13:25:25'),
(139, 56, 23, NULL, 0, '2025-06-03 13:42:22', '2025-06-03 13:42:22'),
(140, 55, 21, NULL, 0, '2025-06-03 14:13:46', '2025-06-03 14:13:46'),
(141, 54, 20, NULL, 0, '2025-06-03 14:30:16', '2025-06-03 14:30:16'),
(142, 53, 31, NULL, 0, '2025-06-03 14:47:26', '2025-06-03 14:47:26'),
(143, 54, 31, NULL, 0, '2025-06-03 14:47:26', '2025-06-03 14:47:26'),
(144, 55, 31, NULL, 0, '2025-06-03 14:47:26', '2025-06-03 14:47:26'),
(145, 66, 30, 'Section 9.1', 0, '2025-06-04 13:18:18', '2025-06-04 13:18:18'),
(146, 67, 30, 'Section 9.1', 0, '2025-06-04 13:25:08', '2025-06-04 13:25:08'),
(147, 68, 30, 'Section 9.2', 0, '2025-06-04 13:27:24', '2025-06-04 13:27:24'),
(148, 68, 33, NULL, 0, '2025-06-04 14:21:47', '2025-06-04 14:21:47'),
(149, 48, 32, 'Mitigation V1-3', 0, '2025-06-04 15:16:11', '2025-06-06 10:04:32'),
(150, 45, 32, 'Mitigation G-2, Mitigation V1-1, Mitigation G-5', 0, '2025-06-04 15:19:39', '2025-06-04 15:50:51'),
(151, 46, 32, 'Mitigation G-2, Mitigation G-5', 0, '2025-06-04 15:19:39', '2025-06-06 10:05:52'),
(152, 56, 32, 'Mitigation V2-1', 0, '2025-06-04 15:23:36', '2025-06-04 15:23:36'),
(153, 53, 32, 'Mitigation V2-4', 0, '2025-06-04 15:29:03', '2025-06-04 15:29:03'),
(154, 54, 32, 'Mitigation V2-4', 0, '2025-06-04 15:29:03', '2025-06-04 15:29:03'),
(155, 55, 32, 'Mitigation V2-4', 0, '2025-06-04 15:29:03', '2025-06-04 15:29:03'),
(156, 69, 32, 'Mitigation G-4', 0, '2025-06-04 15:46:20', '2025-06-04 15:46:20'),
(157, 70, 32, 'Mitigation G-3', 0, '2025-06-04 15:46:20', '2025-06-04 15:46:20'),
(158, 71, 32, 'Mitigation G-4', 0, '2025-06-04 15:46:20', '2025-06-04 15:46:20'),
(159, 72, 32, 'Mitigation G-3', 0, '2025-06-04 15:46:20', '2025-06-04 15:46:20'),
(160, 73, 32, 'Mitigation V2-3', 0, '2025-06-04 16:07:02', '2025-06-04 16:07:02'),
(161, 74, 32, 'Mitigation V1-2', 0, '2025-06-04 16:14:00', '2025-06-04 16:14:00'),
(162, 66, 33, 'Guidance for RSBU', 0, '2025-06-05 08:12:02', '2025-06-05 08:12:02'),
(163, 75, 32, 'Mitigation V2-2', 0, '2025-06-06 10:09:04', '2025-06-06 10:09:04'),
(164, 75, 37, NULL, 1, '2025-06-06 11:28:10', '2025-06-06 11:28:10'),
(165, 56, 30, 'Section 8', 1, '2025-06-06 12:14:37', '2025-06-06 12:14:37'),
(166, 75, 30, 'Section 8', 1, '2025-06-06 12:14:37', '2025-06-06 12:14:37'),
(167, 76, 36, 'Section 7', 0, '2025-06-10 14:42:56', '2025-06-10 14:44:27'),
(168, 75, 36, 'Section 7', 1, '2025-06-10 14:43:32', '2025-06-10 14:43:32'),
(169, 77, 36, 'Section 4.1', 0, '2025-06-10 14:52:40', '2025-06-10 14:52:40'),
(170, 78, 36, 'Section 7', 0, '2025-06-10 14:57:48', '2025-06-10 14:57:48'),
(171, 79, 36, 'Section 5.1, Section 7', 1, '2025-06-10 15:00:56', '2025-06-11 14:41:55'),
(172, 80, 36, 'Section 7', 0, '2025-06-10 15:14:51', '2025-06-10 15:14:51'),
(173, 81, 36, 'Section 4.2', 0, '2025-06-10 15:24:39', '2025-06-10 15:24:39'),
(174, 82, 36, 'Section 7', 0, '2025-06-10 15:30:59', '2025-06-10 15:30:59'),
(175, 54, 36, 'Section 4.2', 0, '2025-06-11 07:59:30', '2025-06-11 07:59:30'),
(176, 83, 35, 'Mitigation Recommendations', 0, '2025-06-11 08:45:45', '2025-06-11 08:45:45'),
(177, 80, 35, 'Mitigation Recommendations', 0, '2025-06-11 08:47:23', '2025-06-11 08:47:23'),
(178, 53, 35, 'Mitigation Recommendations', 0, '2025-06-11 08:48:25', '2025-06-11 08:48:25'),
(179, 76, 35, 'Mitigation Recommendations', 0, '2025-06-11 08:48:55', '2025-06-11 08:48:55'),
(180, 78, 35, 'Mitigation Recommendations', 0, '2025-06-11 08:50:15', '2025-06-11 08:50:15'),
(181, 84, 35, 'Mitigation Recommendations', 0, '2025-06-11 08:52:05', '2025-06-11 08:52:05'),
(182, 81, 35, 'Additional Hardening Options', 0, '2025-06-11 09:17:47', '2025-06-11 09:17:47'),
(183, 85, 35, 'Additional Hardening Options', 0, '2025-06-11 09:23:30', '2025-06-11 09:23:30'),
(184, 86, 35, 'Additional Hardening Options', 0, '2025-06-11 09:32:16', '2025-06-11 09:32:16'),
(185, 56, 34, 'Mitigation', 0, '2025-06-11 13:55:07', '2025-06-11 13:55:07'),
(186, 53, 34, 'Mitigation', 0, '2025-06-11 13:55:07', '2025-06-11 13:55:07'),
(187, 54, 34, 'Mitigation', 0, '2025-06-11 13:55:07', '2025-06-11 13:55:07'),
(188, 55, 34, 'Mitigation', 0, '2025-06-11 13:55:07', '2025-06-11 13:55:07'),
(189, 87, 33, 'Updated Guidance for Branch History Injection and Intra-mode Branch Target Injection', 0, '2025-06-11 14:19:22', '2025-06-11 14:19:22'),
(190, 85, 33, 'Updated Guidance for Branch History Injection and Intra-mode Branch Target Injection', 0, '2025-06-11 14:22:33', '2025-06-11 14:22:33'),
(191, 79, 33, 'Updated Guidance for Branch History Injection and Intra-mode Branch Target Injection', 0, '2025-06-11 14:42:13', '2025-06-11 14:42:13'),
(192, 79, 35, 'Introduction', 0, '2025-06-11 14:43:46', '2025-06-11 14:43:46'),
(193, 45, 38, 'Variant 1/Software Mitigations', 0, '2025-06-12 10:22:28', '2025-06-12 10:47:18'),
(194, 88, 38, 'Variant 1/Software Mitigations', 0, '2025-06-12 10:35:21', '2025-06-12 10:47:14'),
(195, 89, 38, 'Variant 2/Software Mitigations', 0, '2025-06-12 10:47:00', '2025-06-12 10:47:00'),
(196, 90, 38, 'Variant 2/Software Mitigations', 0, '2025-06-12 10:47:00', '2025-06-12 10:47:00'),
(197, 77, 38, 'Variant 2/Software Mitigations', 0, '2025-06-12 10:55:56', '2025-06-12 10:55:56'),
(198, 91, 38, 'Variant 2/Software Mitigations', 0, '2025-06-12 10:55:56', '2025-06-12 10:55:56'),
(199, 92, 38, 'Variant 2/Software Mitigations', 0, '2025-06-12 10:55:56', '2025-06-12 10:55:56'),
(200, 93, 38, 'Variant 2/Software Mitigations', 0, '2025-06-12 10:55:56', '2025-06-12 10:55:56'),
(201, 94, 38, 'Variant 2/Software Mitigations', 0, '2025-06-12 11:09:31', '2025-06-12 11:09:31'),
(202, 95, 38, 'Variant 2/Software Mitigations', 0, '2025-06-12 11:15:24', '2025-06-12 11:15:24'),
(203, 96, 38, 'Variant 3/Software Mitigations', 0, '2025-06-12 11:23:06', '2025-06-12 11:23:06'),
(204, 97, 38, 'Subvariant 3a/Software Mitigations', 0, '2025-06-12 11:29:12', '2025-06-12 11:29:12'),
(205, 98, 38, 'Subvariant 3a/Software Mitigations', 0, '2025-06-12 11:32:07', '2025-06-12 11:32:07'),
(206, 99, 38, 'Variant 4/Software Mitigations', 0, '2025-06-12 11:58:48', '2025-06-12 11:58:48'),
(207, 85, 39, NULL, 0, '2025-06-12 13:17:52', '2025-06-12 13:17:52'),
(208, 100, 39, 'FEAT_ECBHB', 0, '2025-06-12 13:22:46', '2025-06-12 13:22:46'),
(209, 101, 39, 'CSV2 Update', 0, '2025-06-12 13:48:29', '2025-06-12 13:48:29'),
(210, 101, 36, 'Section 4.2', 0, '2025-06-12 13:48:29', '2025-06-12 13:48:29'),
(211, 102, 40, 'Section 9', 0, '2025-06-20 14:59:11', '2025-06-20 14:59:11'),
(212, 103, 40, 'Section 9', 0, '2025-06-20 15:00:58', '2025-06-20 15:00:58'),
(213, 109, 41, 'Section 6.1.1', 0, '2025-06-23 12:43:02', '2025-06-23 12:43:02'),
(214, 110, 41, 'Section 6.1.1', 0, '2025-06-23 12:43:02', '2025-06-23 12:43:02'),
(215, 111, 41, 'Section 6.1.2', 0, '2025-06-23 12:43:02', '2025-06-23 12:43:02'),
(216, 112, 41, 'Section 6.1.3', 0, '2025-06-23 12:43:02', '2025-06-23 12:43:02'),
(217, 94, 41, 'Section 6.1.3', 0, '2025-06-23 12:43:02', '2025-06-23 12:43:02'),
(218, 113, 41, 'Section 6.1.1', 0, '2025-06-23 12:52:53', '2025-06-23 12:52:53'),
(219, 114, 41, 'Section 6.1.3', 0, '2025-06-23 12:52:53', '2025-06-23 12:52:53'),
(220, 115, 42, 'Section 2.3', 0, '2025-06-27 15:02:06', '2025-06-27 15:02:06'),
(221, 88, 42, 'Section 3.3.1', 0, '2025-06-27 15:45:13', '2025-06-27 15:45:13'),
(222, 127, 42, 'Section 3.3.2', 0, '2025-06-27 15:45:13', '2025-06-27 15:45:13'),
(223, 123, 42, 'Section 3.3.3', 0, '2025-06-27 15:45:13', '2025-06-27 15:45:13'),
(224, 124, 42, 'Section 4.1', 0, '2025-06-27 15:45:13', '2025-06-27 15:45:13'),
(225, 125, 42, 'Section 4.2', 0, '2025-06-27 15:45:13', '2025-06-27 15:45:13'),
(226, 126, 42, 'Section 4.3', 0, '2025-06-27 15:45:13', '2025-06-27 15:45:13'),
(227, 123, 43, 'Variant #1.1 and #1.2 attacks', 0, '2025-07-14 13:19:17', '2025-07-14 13:19:17'),
(228, 128, 43, 'Variant #1.1 and #1.2 attacks', 0, '2025-07-14 13:19:17', '2025-07-14 13:19:17'),
(229, 129, 43, 'High Level Mitigation Approach', 0, '2025-07-14 13:19:17', '2025-07-14 13:19:17'),
(230, 45, 43, 'High-Level Alternative Mitigation Strategies', 0, '2025-07-14 13:20:12', '2025-07-14 13:20:12'),
(232, 131, 43, 'Variant #1.1 and #1.2 attacks', 0, '2025-07-14 13:22:01', '2025-07-14 13:22:01'),
(233, 56, 43, 'Indirect Branches, Calls, and Returns', 0, '2025-07-14 13:22:40', '2025-07-14 13:22:40'),
(234, 132, 47, 'Section 9.2', 0, '2025-07-16 14:59:56', '2025-07-16 14:59:56'),
(235, 53, 47, 'Section 5.2', 1, '2025-07-16 15:01:31', '2025-07-16 15:01:31'),
(236, 133, 47, 'Section 9.1', 0, '2025-07-16 15:06:26', '2025-07-16 15:06:26'),
(237, 134, 47, 'Section 9.2', 0, '2025-07-16 15:09:41', '2025-07-16 15:09:41'),
(238, 135, 47, 'Section 9.1', 0, '2025-07-16 15:17:23', '2025-07-16 15:17:23'),
(239, 136, 49, 'Section 2.4', 0, '2025-07-17 10:58:00', '2025-07-17 10:58:00'),
(240, 53, 49, 'Section 2.1', 0, '2025-07-17 11:02:21', '2025-07-17 11:02:21'),
(241, 54, 49, 'Section 2.1', 0, '2025-07-17 11:02:21', '2025-07-17 11:02:21'),
(242, 55, 49, 'Section 2.1', 0, '2025-07-17 11:02:21', '2025-07-17 11:02:21'),
(243, 56, 49, 'Section 2.1', 0, '2025-07-17 11:02:21', '2025-07-17 11:02:21'),
(244, 137, 49, 'Section 2.1', 0, '2025-07-17 11:13:41', '2025-07-17 11:13:41'),
(245, 138, 45, 'Section 9', 1, '2025-07-18 12:28:50', '2025-07-18 12:28:50'),
(246, 81, 45, 'Section 8.1', 1, '2025-07-18 12:34:39', '2025-07-18 12:34:39'),
(247, 80, 45, 'Section 2.4', 0, '2025-07-18 12:36:53', '2025-07-18 12:36:53'),
(248, 84, 45, 'Section 10', 0, '2025-07-18 12:37:48', '2025-07-18 12:37:48'),
(249, 76, 45, 'Section 10', 0, '2025-07-18 12:38:39', '2025-07-18 12:38:39'),
(250, 85, 45, 'Section 2.4', 0, '2025-07-18 12:40:49', '2025-07-18 12:40:49'),
(251, 86, 45, 'Section 10', 0, '2025-07-18 12:47:28', '2025-07-18 12:47:28'),
(252, 147, 50, 'Section 7.2', 0, '2025-07-18 13:15:50', '2025-08-13 09:31:52'),
(253, 139, 53, 'Section \"Solution\"', 0, '2025-08-05 10:33:53', '2025-08-05 10:33:53'),
(254, 140, 30, 'Section 9.1', 0, '2025-08-07 08:11:20', '2025-08-07 08:11:20'),
(255, 141, 30, 'Section 9.1', 0, '2025-08-07 08:13:02', '2025-08-07 08:13:02'),
(256, 142, 36, 'Section 7', 0, '2025-08-07 08:49:47', '2025-08-07 08:49:47'),
(257, 143, 12, 'Section IX', 0, '2025-08-07 12:55:13', '2025-08-07 12:55:13'),
(258, 144, 11, 'Section 7', 0, '2025-08-07 12:55:13', '2025-08-07 12:55:13'),
(259, 65, 64, 'Process Isolation', 0, '2025-08-13 08:29:59', '2025-08-13 08:29:59'),
(260, 145, 64, 'Using LFENCE to Control Speculative Load Execution', 0, '2025-08-13 08:29:59', '2025-08-13 08:29:59'),
(261, 146, 64, 'Speculative Store Bypass Disable (SSBD)', 0, '2025-08-13 08:29:59', '2025-08-13 08:29:59');
-- --------------------------------------------------------
--
-- Table structure for table `documents`
--
CREATE TABLE `documents` (
`id` int(11) NOT NULL,
`title` text NOT NULL,
`authors` text NOT NULL,
`publisher_id` int(11) NOT NULL,
`bibtex_key` varchar(128) DEFAULT NULL,
`year` int(11) NOT NULL COMMENT 'As it should appear in BibTeX',
`publication_date` date NOT NULL COMMENT 'For academic papers, this is the day when the paper was made accessible to the general public (including near-final preprints).\r\nFor vendor documents, this is the date of publication. If there are multiple revisions, put the date of the latest revision at the time of adding it to the database.',
`url` text DEFAULT NULL,
`type` varchar(128) NOT NULL COMMENT 'Attack/Defense',
`has_reversing` tinyint(1) DEFAULT NULL COMMENT 'Whether the paper has a significant uarch reversing section',
`comment` text DEFAULT NULL,
`ready` tinyint(1) NOT NULL DEFAULT 0,
`created` timestamp NOT NULL DEFAULT current_timestamp(),
`updated` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci;
--
-- Dumping data for table `documents`
--
INSERT INTO `documents` (`id`, `title`, `authors`, `publisher_id`, `bibtex_key`, `year`, `publication_date`, `url`, `type`, `has_reversing`, `comment`, `ready`, `created`, `updated`) VALUES
(1, 'PreFence: A Fine-Grained and Scheduling-Aware Defense Against Prefetching-Based Attacks', 'Till Schlüter, Nils Ole Tippenhauer', 2, 'prefence', 2025, '2025-04-14', 'https://publications.cispa.de/ndownloader/files/53639078', 'Defense', 0, NULL, 1, '2025-05-14 15:24:09', '2025-08-14 16:03:18'),
(2, 'Unveiling Hardware-based Data Prefetcher, a Hidden Source of Information Leakage', 'Youngjoo Shin, Hyung Chan Kim, Dokeun Kwon, Ji Hoon Jeong, Junbeom Hur', 3, 'shin-prefetch', 2018, '2018-10-15', 'https://dl.acm.org/doi/pdf/10.1145/3243734.3243736', 'Attack', 1, NULL, 1, '2025-05-14 15:24:09', '2025-08-14 16:02:33'),
(4, 'Spectre Attacks: Exploiting Speculative Execution', 'Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, Yuval Yarom', 4, 'spectre', 2019, '2018-01-03', 'https://spectreattack.com/spectre.pdf', 'Attack', 1, 'The paper does not clearly map defenses to attack variants. I tried to represent it at best as possible.', 1, '2025-05-26 08:47:30', '2025-08-14 16:02:33'),
(5, 'Meltdown: Reading Kernel Memory from User Space', 'Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, Mike Hamburg', 1, 'meltdown', 2018, '2018-01-03', 'https://meltdownattack.com/meltdown.pdf', 'Attack', 0, NULL, 0, '2025-05-26 08:58:03', '2025-08-14 16:02:33'),
(10, 'AfterImage: Leaking Control Flow Data and Tracking Load Operations via the Hardware Prefetcher', 'Yun Chen, Lingfeng Pei, Trevor E. Carlson', 6, 'afterimage', 2023, '2023-01-30', 'https://dl.acm.org/doi/pdf/10.1145/3575693.3575719', 'Attack', 1, NULL, 1, '2025-05-26 10:53:15', '2025-08-14 16:02:33'),
(11, 'FetchBench: Systematic Identification and Characterization of Proprietary Prefetchers', 'Till Schlüter, Amit Choudhari, Lorenz Hetterich, Leon Trampert, Hamed Nemati, Ahmad Ibrahim, Michael Schwarz, Christian Rossow, Nils Ole Tippenhauer', 3, 'fetchbench', 2023, '2023-11-21', 'https://dl.acm.org/doi/pdf/10.1145/3576915.3623124', 'Attack', 1, 'Has 1 non-TEE attack and 1 TEE covert channel', 1, '2025-05-26 10:54:46', '2025-08-14 16:02:33'),
(12, 'PREFETCHX: Cross-Core Cache-Agnostic Prefetcher-Based Side-Channel Attacks', 'Yun Chen, Ali Hajiabadi, Lingfeng Pei, Trevor E. Carlson', 16, 'chen:2024:prefetchx', 2024, '2024-04-02', 'https://www.comp.nus.edu.sg/~tcarlson/pdfs/chen2024nccapsac.pdf', 'Attack', 1, NULL, 1, '2025-05-26 10:56:42', '2025-08-14 16:02:33'),
(13, 'Augury: Using Data Memory-Dependent Prefetchers to Leak Data at Rest', 'Jose Rodrigo Sanchez Vicarte, Michael Flanders, Riccardo Paccagnella, Grant Garrett-Grossman, Adam Morrison, Christopher W. Fletcher, David Kohlbrenner', 4, 'augury', 2022, '2022-07-27', 'https://www.prefetchers.info/augury.pdf', 'Attack', 1, NULL, 1, '2025-05-26 10:58:34', '2025-08-14 16:02:33'),
(14, 'GoFetch: Breaking Constant-Time Cryptographic Implementations Using Data Memory-Dependent Prefetchers', 'Boru Chen, Yingchen Wang, Pradyumna Shome, Christopher W. Fletcher, David Kohlbrenner, Riccardo Paccagnella, Daniel Genkin', 1, 'chen:2024:gofetch', 2024, '2024-03-21', 'https://gofetch.fail/files/gofetch.pdf', 'Attack', 1, NULL, 1, '2025-05-26 11:39:26', '2025-08-14 16:02:33'),
(15, 'Raccoon: Closing Digital Side-Channels through Obfuscated Execution', 'Ashay Rane, Calvin Lin, Mohit Tiwari', 1, 'rane:2015', 2015, '2015-08-12', 'https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-rane.pdf', 'Defense', 0, 'Referenced by AfterImage for oblivious execution. Does not specify the processors used for the evaluation (only \"two Intel Xeon (Sandy Bridge) processors\")', 1, '2025-05-26 13:50:55', '2025-08-14 16:02:33'),
(16, 'ShadowLoad: Injecting State into Hardware Prefetchers', 'Lorenz Hetterich, Fabian Thomas, Lukas Gerlach, Ruiyi Zhang, Nils Bernsdorf, Eduard Ebert, Michael Schwarz', 6, 'hetterich:2025:shadowload', 2025, '2025-03-30', 'https://dl.acm.org/doi/pdf/10.1145/3676641.3716020', 'Attack', 1, NULL, 1, '2025-05-28 12:57:53', '2025-08-14 16:02:33'),
(17, 'Indirect Branch Restricted Speculation', 'Intel Corp.', 9, 'intel-ibrs', 2018, '2018-01-03', 'https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/indirect-branch-restricted-speculation.html', 'Defense', 0, 'Referenced by ShadowLoad', 1, '2025-05-28 14:30:24', '2025-08-14 18:13:56'),
(18, 'speculative execution, variant 4: speculative store bypass', 'Jann Horn', 17, 'horn:2018:spectrev4', 2018, '2018-02-06', 'https://project-zero.issues.chromium.org/issues/42450580', 'Attack', 1, NULL, 1, '2025-05-30 11:00:47', '2025-08-14 16:03:53'),
(19, 'What Spectre and Meltdown Mean For WebKit', 'Filip Pizlo', 27, 'pizlo:2018:webkit', 2018, '2018-01-08', 'https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-for-webkit/', 'Defense', 0, NULL, 1, '2025-05-30 12:55:59', '2025-08-14 16:04:24'),
(20, 'Single Thread Indirect Branch Predictors', 'Intel Corp.', 9, 'intel:2018:stibp', 2018, '2018-01-03', 'https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/single-thread-indirect-branch-predictors.html', 'Defense', 0, NULL, 1, '2025-06-02 10:41:33', '2025-08-14 18:14:28'),
(21, 'Indirect Branch Predictor Barrier', 'Intel Corp.', 9, 'intel:2018:ibpb', 2018, '2018-01-03', 'https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/indirect-branch-predictor-barrier.html', 'Defense', 0, NULL, 1, '2025-06-02 10:42:01', '2025-08-14 18:14:29'),
(22, 'Retpoline: a software construct for preventing branch-target-injection', 'Paul Turner', 19, 'turner:2018:retpoline', 2018, '2018-01-04', 'https://support.google.com/faqs/answer/7625886', 'Defense', 0, NULL, 1, '2025-06-02 10:51:23', '2025-08-14 16:04:59'),
(23, 'Retpoline: A Branch Target Injection Mitigation', 'Intel Corp.', 9, 'intel:2022:retpoline', 2022, '2022-08-22', 'https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/retpoline-branch-target-injection-mitigation.html', 'Defense', 0, 'Version 2.0', 1, '2025-06-02 10:52:17', '2025-08-14 18:14:41'),
(24, 'Mitigating Spectre with Site Isolation in Chrome', 'Charlie Reis', 28, 'reis:2018:spectre-chrome', 2018, '2018-07-11', 'https://security.googleblog.com/2018/07/mitigating-spectre-with-site-isolation.html', 'Defense', 0, 'Post on the Google Security Blog. The document is very vague about which variants of Spectre Site Isolation actually prevents, so I put only variant 1 for now.', 1, '2025-06-02 12:23:30', '2025-08-14 16:05:14'),
(25, 'Mitigating speculative execution side-channel attacks in Microsoft Edge and Internet Explorer', 'Microsoft Edge Team ', 23, 'edge-team:2018', 2018, '2018-01-03', 'https://blogs.windows.com/msedgedev/2018/01/03/speculative-execution-mitigations-microsoft-edge-internet-explorer/', 'Defense', 0, NULL, 1, '2025-06-02 12:33:32', '2025-08-14 16:05:26'),
(28, 'Mitigations landing for new class of timing attack', 'Luke Wagner', 21, 'wagner:2018:mozilla', 2018, '2018-01-03', 'https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/', 'Defense', 0, NULL, 1, '2025-06-02 12:49:15', '2025-08-14 16:05:37'),
(29, 'Spectre mitigations in MSVC', 'Andrew Pardoe', 24, 'pardoe:2018:msvc', 2018, '2018-01-15', 'https://devblogs.microsoft.com/cppblog/spectre-mitigations-in-msvc/', 'Defense', 0, 'Discusses the /Qspectre compiler switch', 1, '2025-06-02 13:13:48', '2025-08-14 16:06:14'),
(30, 'RETBLEED: Arbitrary Speculative Code Execution with Return Instructions', 'Johannes Wikner, Kaveh Razavi', 1, 'wikner:2022:retbleed', 2022, '2022-03-12', 'https://www.usenix.org/system/files/sec22-wikner.pdf', 'Attack', 1, 'Also reverse-engineers the BTB on Intel (Haswell to Alder Lake) and AMD (Zen 1-3)', 1, '2025-06-03 14:03:58', '2025-08-14 16:07:32'),
(31, 'AMD64 Technology Indirect Branch Control Extension', 'AMD Inc.', 12, 'amd:2018:ibc', 2018, '2018-07-10', 'https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/white-papers/111006-architecture-guidelines-update-amd64-technology-indirect-branch-control-extension.pdf', 'Defense', 0, NULL, 1, '2025-06-03 14:44:32', '2025-08-14 18:15:14'),
(32, 'Software Techniques for Managing Speculation on AMD Processors', 'AMD Inc.', 12, 'amd:2023:speculation', 2023, '2023-09-05', 'https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/software-techniques-for-managing-speculation.pdf', 'Defense', 0, 'AMD\'s recommended mitigations against Spectre v1/v2. Revision 5.09.23.', 1, '2025-06-04 09:50:37', '2025-08-14 18:15:35'),
(33, 'Return Stack Buffer Underflow / CVE-2022-29901, CVE-2022-28693 / INTEL-SA-00702', 'Intel Corp.', 9, 'intel:2022:sa:rsbu', 2022, '2022-07-12', 'https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/return-stack-buffer-underflow.html', 'Defense', 0, NULL, 1, '2025-06-04 14:16:26', '2025-08-14 18:15:46'),
(34, 'Branch Target Injection / CVE-2017-5715 / INTEL-SA-00088', 'Intel Corp.', 9, 'intel:2018:sa:bti', 2018, '2018-01-03', 'https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/branch-target-injection.html', 'Defense', 0, NULL, 1, '2025-06-04 14:27:27', '2025-08-14 18:15:57'),
(35, 'Branch History Injection and Intra-mode Branch Target Injection / CVE-2022-0001, CVE-2022-0002 / INTEL-SA-00598', 'Intel Corp.', 9, 'intel:2025:sa:bhi', 2025, '2025-05-12', 'https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html', 'Defense', 0, NULL, 1, '2025-06-04 14:28:32', '2025-08-14 18:16:16'),
(36, 'Branch History Injection: On the Effectiveness of Hardware Mitigations Against Cross-Privilege Spectre-v2 Attacks', 'Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, Cristiano Giuffrida', 1, 'barberis:2022:bhi', 2022, '2022-03-08', 'https://www.usenix.org/system/files/sec22-barberis.pdf', 'Attack', 1, NULL, 1, '2025-06-05 08:47:23', '2025-08-14 16:08:29'),
(37, 'LFENCE/JMP Mitigation Update for CVE-2017-5715', 'AMD Inc.', 12, 'amd:2022:lfence-jmp', 2022, '2022-08-03', 'https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1036.html', 'Defense', 0, NULL, 1, '2025-06-06 10:11:36', '2025-08-14 18:18:30'),
(38, 'Cache Speculation Side-channels', 'Arm Ltd.', 10, 'arm:2020:sidechannels', 2020, '2020-06-08', 'https://developer.arm.com/documentation/102816/0205/', 'Defense', 0, 'Version 2.5', 1, '2025-06-12 08:03:35', '2025-08-14 18:18:54'),
(39, 'Spectre-BHB: Speculative Target Reuse Attacks', 'Arm Ltd.', 10, 'arm:2025:spectre-bhb', 2025, '2025-01-16', 'https://developer.arm.com/documentation/102898/0108/', 'Defense', 0, 'Version 1.8', 1, '2025-06-12 08:04:26', '2025-08-14 18:24:41'),
(40, 'Spectre Returns! Speculation Attacks using the Return Stack Buffer', 'Esmaeil Mohammadian Koruyeh, Khaled N. Khasawneh, Chengyu Song, Nael Abu-Ghazaleh', 29, 'esmaeil:2018:spectrereturns', 2018, '2018-08-13', 'https://www.usenix.org/system/files/conference/woot18/woot18-paper-koruyeh.pdf', 'Attack', 1, 'Contains an SGX variant (\"Attack 3\"/Section 6) that we do not cover here.', 1, '2025-06-12 12:09:48', '2025-08-14 18:34:01'),
(41, 'ret2spec: Speculative Execution Using Return Stack Buffers', 'Giorgi Maisuradze, Christian Rossow', 3, 'maisuradze:2018:ret2spec', 2018, '2018-10-15', 'https://dl.acm.org/doi/10.1145/3243734.3243761', 'Attack', 1, NULL, 1, '2025-06-12 12:13:32', '2025-08-14 18:31:57'),
(42, 'Speculative Buffer Overflows: Attacks and Defenses', 'Vladimir Kiriansky, Carl Waldspurger', 30, 'kiriansky:2018', 2018, '2018-07-10', 'https://arxiv.org/pdf/1807.03757', 'Attack', 0, 'This is a preprint, could not find a peer-reviewed version. The paper is also not very precise about the proposed defenses.', 1, '2025-06-12 13:56:43', '2025-08-14 18:25:14'),
(43, 'Speculative Load Hardening — LLVM 21.0.0git documentation', 'LLVM Project', 26, 'llvm:2025:slh', 2023, '2023-10-04', 'https://llvm.org/docs/SpeculativeLoadHardening.html', 'Defense', 0, NULL, 1, '2025-06-27 15:50:25', '2025-08-14 18:26:42'),
(44, 'Intel® 64 and IA-32 Architectures Software Developer\'s Manual, Combined Volumes: 1, 2A, 2B, 2C, 2D, 3A, 3B, 3C, 3D, and 4', 'Intel Corp.', 9, 'intel:2024:sdm', 2024, '2024-06-01', 'https://cdrdv2-public.intel.com/825743/325462-sdm-vol-1-2abcd-3abcd-4.pdf', 'Defense', 0, 'Revision: June 2024\nDue to its excessive size, this document is not fully covered.', 1, '2025-07-14 14:16:14', '2025-10-01 11:54:57'),
(45, 'InSpectre Gadget: Inspecting the Residual Attack Surface of Cross-privilege Spectre v2', 'Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, Cristiano Giuffrida', 1, 'wiebing:2024:inspectre-gadget', 2024, '2024-04-09', 'https://www.usenix.org/system/files/usenixsecurity24-wiebing.pdf', 'Defense', 0, 'Mainly a tool paper to find Spectre-v2 gadgets in the Linux kernel. However, the paper uncovered that Spectre-BHB (aka BTI) can practically be used to leak kernel memory from user space, not only from privileged code such as eBPF.', 1, '2025-07-15 12:07:35', '2025-08-14 18:28:56'),
(46, 'Breaking the Barrier: Post-Barrier Spectre Attacks', 'Johannes Wikner, Kaveh Razavi', 4, 'wikner:2025:breaking-barrier', 2025, '2025-06-16', 'https://ieeexplore.ieee.org/document/11023301', 'Attack', 1, NULL, 0, '2025-07-15 12:08:50', '2025-08-14 18:29:25'),
(47, 'Branch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by Exploiting Branch Predictor Race Conditions', 'Sandro Rüegge, Johannes Wikner, Kaveh Razavi', 1, 'rueegge:2025:bpi', 2025, '2025-05-13', 'https://comsec.ethz.ch/wp-content/files/bprc_sec25.pdf', 'Attack', 1, NULL, 1, '2025-07-15 12:12:35', '2025-08-14 18:29:55'),
(48, 'Inception: Exposing New Attack Surfaces with Training in Transient Execution', 'Daniël Trujillo, Johannes Wikner, Kaveh Razavi', 1, 'trujillo:2023:inception', 2023, '2023-08-08', 'https://www.usenix.org/system/files/usenixsecurity23-trujillo.pdf', 'Attack', 1, NULL, 0, '2025-07-15 12:47:26', '2025-08-14 18:30:38'),
(49, 'JumpSwitches: Restoring the Performance of Indirect Branches In the Era of Spectre', 'Nadav Amit, Fred Jacobs, Michael Wei', 31, 'amit:2019:jumpswitches', 2019, '2019-07-10', 'https://www.usenix.org/system/files/atc19-amit.pdf', 'Defense', 0, NULL, 1, '2025-07-16 15:13:40', '2025-08-14 18:31:06'),
(50, 'FineIBT: Fine-grain Control-flow Enforcement with Indirect Branch Tracking', 'Alexander J. Gaidis, Joao Moreira, Ke Sun, Alyssa Milburn, Vaggelis Atlidakis, Vasileios P. Kemerlis', 32, 'gaidis:2023:fineibt', 2023, '2023-10-16', 'https://dl.acm.org/doi/pdf/10.1145/3607199.3607219', 'Defense', 0, NULL, 1, '2025-07-18 13:03:26', '2025-08-14 18:31:22'),
(51, 'Enter, Exit, Page Fault, Leak: Testing Isolation Boundaries for Microarchitectural Leaks', 'Oleksii Oleksenko, Flavien Solt, Cédric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos', 4, 'oleksenko:2026:enterexit', 2026, '2025-07-08', 'https://www.microsoft.com/en-us/research/wp-content/uploads/2025/07/Enter-Exit-SP26.pdf', 'Attack', 0, 'TODO: More a tool paper, need to check if relevant', 0, '2025-07-18 13:32:47', '2025-08-14 18:43:05'),
(52, 'Training Solo: On the Limitations of Domain Isolation Against Spectre-v2 Attacks', 'Sander Wiebing, Cristiano Giuffrida', 4, 'wiebing:2025:training-solo', 2025, '2025-05-12', 'https://ieeexplore.ieee.org/abstract/document/11023266', 'Attack', 1, NULL, 0, '2025-08-04 14:51:10', '2025-08-14 18:33:21'),
(53, 'Reptar', 'Tavis Ormandy', 18, 'ormandy:2024:reptar', 2023, '2023-11-15', 'https://lock.cmpxchg8b.com/reptar.html', 'Attack', 0, NULL, 1, '2025-08-04 14:54:47', '2025-08-14 18:32:45'),
(54, 'ÆPIC Leak: Architecturally Leaking Uninitialized Data from the Microarchitecture', 'Pietro Borrello, Andreas Kogler, Martin Schwarzl, Moritz Lipp, Daniel Gruss, Michael Schwarz', 1, 'borrello:2022:aepic-leak', 2022, '2022-08-11', 'https://aepicleak.com/aepicleak.pdf', 'Attack', 1, NULL, 0, '2025-08-04 14:55:21', '2025-08-14 18:35:30'),
(55, 'Rage Against the Machine Clear: A Systematic Analysis of Machine Clears and Their Implications for Transient Execution Attacks', 'Hany Ragab, Enrico Barberis, Herbert Bos, and Cristiano Giuffrida', 1, 'ragab:2021:rage-against', 2021, '2021-06-08', 'https://www.usenix.org/system/files/sec21-ragab.pdf', 'Attack', 1, NULL, 0, '2025-08-04 14:55:59', '2025-08-14 18:37:43'),
(56, 'PLATYPUS: Software-based Power Side-Channel Attacks on x86', 'Moritz Lipp, Andreas Kogler, David Oswald, Michael Schwarz, Catherine Easdon, Claudio Canella, Daniel Gruss', 4, 'lipp:2021:platypus', 2020, '2020-11-10', 'https://platypusattack.com/platypus.pdf', 'Attack', 0, NULL, 0, '2025-08-04 14:56:39', '2025-08-14 18:38:49'),
(57, 'Collide+Power: Leaking Inaccessible Data with Software-based Power Side Channels', 'Andreas Kogler, Jonas Juffinger, Lukas Giner, Lukas Gerlach, Martin Schwarzl, Michael Schwarz, Daniel Gruss, Stefan Mangard', 1, 'kogler:2023:collide-power', 2023, '2023-08-01', 'https://collidepower.com/paper/Collide+Power.pdf', 'Attack', 0, NULL, 0, '2025-08-04 14:59:46', '2025-08-14 18:39:42'),
(58, 'Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86', 'Yingchen Wang, Riccardo Paccagnella, Elizabeth Tang He, Hovav Shacham, Christopher Fletcher, David Kohlbrenner\n', 1, 'wang:2022:hertzbleed', 2022, '2022-06-14', 'https://www.hertzbleed.com/hertzbleed.pdf', 'Attack', 0, NULL, 0, '2025-08-04 15:02:03', '2025-08-14 18:40:19'),
(60, 'Phantom: Exploiting Decoder-detectable Mispredictions', 'Johannes Wikner, Daniël Trujillo, Kaveh Razavi', 7, 'wikner:2023:phantom', 2023, '2023-12-08', 'https://dl.acm.org/doi/pdf/10.1145/3613424.3614275', 'Attack', 1, NULL, 0, '2025-08-05 10:42:51', '2025-08-14 18:40:32'),
(61, 'TagBleed: Breaking KASLR on the Isolated Kernel Address Space using Tagged TLBs', 'Jakob Koschel, Cristiano Giuffrida, Herbert Bos, Kaveh Razavi', 2, 'koschel:2020:tagbleed', 2020, '2020-11-02', 'https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9230388', 'Attack', 1, NULL, 0, '2025-08-05 10:44:28', '2025-08-14 18:40:58'),
(62, 'BunnyHop: Exploiting the Instruction Prefetcher', 'Zhiyuan Zhang, Mingtian Tao, Sioli O\'Connell, Chitchanok Chuengsatiansup, Daniel Genkin, Yuval Yarom', 1, 'zhang:2023:bunnyhop', 2023, '2023-08-11', 'https://www.usenix.org/system/files/usenixsecurity23-zhang-zhiyuan-bunnyhop.pdf', 'Attack', 1, NULL, 0, '2025-08-05 11:03:42', '2025-08-14 18:42:05'),
(63, 'You Cannot Always Win the Race: Analyzing mitigations for branch target prediction attacks', 'Alyssa Milburn, Ke Sun, Henrique Kawakami', 2, 'milburn:2023:cannot-always-win', 2023, '2023-07-31', 'https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=10190478', 'Attack', 0, NULL, 0, '2025-08-05 11:28:34', '2025-08-14 18:12:27'),
(64, 'Speculative Store Bypass / CVE-2018-3639 / INTEL-SA-00115', 'Intel Corp.', 9, 'intel:2018:sa:ssb', 2018, '2018-05-21', 'https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/speculative-store-bypass.html', 'Defense', 0, NULL, 1, '2025-08-06 15:07:42', '2025-08-14 18:13:35'),
(65, 'Intel Affected Processor List', 'Intel Corp.', 9, 'intel:2025:affected-list', 2025, '2025-05-13', 'https://github.com/intel/Intel-affected-processor-list/blob/3a84f776ea6ea013ee1d982735df4426a50554c4/Intel_affected_processor_list.csv', '', 0, NULL, 0, '2025-08-08 14:06:04', '2025-09-30 14:53:28'),
(66, 'Arm CPU Security Bulletin: Spectre/Meltdown', 'Arm Ltd.', 10, 'arm:2025:bulletin:spectre-meltdown', 2025, '2025-07-23', 'https://developer.arm.com/documentation/110280/latest/', '', 0, NULL, 0, '2025-08-11 08:19:49', '2025-09-30 14:53:27');
-- --------------------------------------------------------
--
-- Table structure for table `document_describes_attack`
--
CREATE TABLE `document_describes_attack` (
`id` int(11) NOT NULL,
`document_id` int(11) NOT NULL,
`attack_id` int(11) NOT NULL,
`section` text DEFAULT NULL,
`created` timestamp NOT NULL DEFAULT current_timestamp(),
`updated` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci;
--
-- Dumping data for table `document_describes_attack`
--
INSERT INTO `document_describes_attack` (`id`, `document_id`, `attack_id`, `section`, `created`, `updated`) VALUES
(1, 2, 1, 'Section 6', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(2, 10, 3, 'Section 5-7', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(3, 11, 3, 'Section 5', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(4, 12, 4, 'Section V.A', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(5, 15, 5, 'Section 1', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(6, 13, 6, 'Section VII', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(7, 14, 6, 'Section 5-6', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(8, 1, 6, 'Section 4, Appendix A', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(9, 1, 3, 'Section 4, Appendix A', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(10, 1, 1, 'Section 4, Appendix A', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(11, 1, 4, 'Section 4, Appendix A', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(13, 16, 9, 'Section 3.2', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(14, 16, 7, 'Section 3.1', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(15, 4, 10, 'Section IV', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(16, 4, 11, 'Section V', '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(17, 4, 12, 'Section VI (marginally)', '2025-06-02 13:27:55', '2025-06-03 10:50:10'),
(18, 18, 12, NULL, '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(19, 19, 10, NULL, '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(20, 17, 12, NULL, '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(21, 17, 11, NULL, '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(22, 25, 10, NULL, '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(23, 25, 11, NULL, '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(24, 25, 13, NULL, '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(25, 28, 10, NULL, '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(26, 28, 11, NULL, '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(27, 28, 13, NULL, '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(28, 29, 10, NULL, '2025-06-02 13:27:55', '2025-06-02 13:27:55'),
(29, 24, 10, NULL, '2025-06-03 13:18:18', '2025-06-03 13:18:18'),
(30, 22, 11, NULL, '2025-06-03 13:24:48', '2025-06-03 13:24:48'),
(31, 23, 11, 'Introduction', '2025-06-03 13:35:04', '2025-06-03 13:35:04'),
(32, 23, 14, NULL, '2025-06-03 13:39:36', '2025-06-03 13:39:36'),
(33, 21, 11, NULL, '2025-06-03 14:12:57', '2025-06-03 14:12:57'),
(34, 20, 11, NULL, '2025-06-03 14:29:19', '2025-06-03 14:29:19'),
(35, 31, 11, 'Usage', '2025-06-03 14:45:35', '2025-06-03 14:45:35'),
(36, 30, 15, 'Section 5.2', '2025-06-04 13:11:15', '2025-06-04 13:11:15'),
(37, 30, 14, 'Section 5.2', '2025-06-04 13:11:15', '2025-06-04 13:11:15'),
(38, 33, 14, NULL, '2025-06-04 14:23:08', '2025-06-04 14:23:08'),
(39, 32, 10, NULL, '2025-06-04 15:05:53', '2025-06-04 15:05:53'),
(40, 32, 11, NULL, '2025-06-04 15:05:53', '2025-06-04 15:05:53'),
(41, 37, 11, NULL, '2025-06-06 10:11:49', '2025-06-06 10:11:49'),
(42, 36, 16, 'Section 5', '2025-06-10 14:01:33', '2025-06-10 14:01:33'),
(43, 36, 11, 'Section 2.2', '2025-06-10 14:22:00', '2025-06-10 14:22:00'),
(44, 35, 16, NULL, '2025-06-11 09:25:09', '2025-06-11 09:25:09'),
(45, 30, 11, 'Section 1, Section 2 (marginally, as context)', '2025-06-11 11:22:49', '2025-06-11 11:22:49'),
(46, 35, 11, '(marginally)', '2025-06-11 11:22:49', '2025-06-11 11:22:49'),
(47, 34, 11, NULL, '2025-06-11 13:51:29', '2025-06-11 13:51:29'),
(48, 33, 16, 'Updated Guidance for Branch History Injection and Intra-mode Branch Target Injection', '2025-06-11 13:57:27', '2025-06-11 13:57:27'),
(49, 38, 10, 'Variant 1/Software Mitigations', '2025-06-12 12:03:01', '2025-06-12 12:03:01'),
(50, 38, 11, 'Variant 2/Software Mitigations ', '2025-06-12 12:03:01', '2025-06-12 12:03:01'),
(51, 38, 12, 'Variant 4/Software Mitigations', '2025-06-12 12:03:01', '2025-06-12 12:03:01'),
(52, 38, 13, 'Variant 3/Software Mitigations', '2025-06-12 12:03:01', '2025-06-12 12:03:01'),
(53, 38, 17, 'Variant 1/Software Mitigations', '2025-06-12 12:03:01', '2025-06-12 12:03:01'),
(54, 38, 18, 'Variant 2/Software Mitigations', '2025-06-12 12:03:01', '2025-06-12 12:03:01'),
(55, 38, 19, 'Subvariant 3a/Software Mitigations', '2025-06-12 12:03:01', '2025-06-12 12:03:01'),
(56, 39, 16, NULL, '2025-06-12 13:18:10', '2025-06-12 13:51:03'),
(57, 40, 18, 'Section 4-7', '2025-06-20 14:50:12', '2025-06-20 14:50:12'),
(58, 41, 18, 'Section 4 (cross-process in user space), Section 5 (inner-process in user space)', '2025-06-23 08:49:43', '2025-06-23 11:40:48'),
(59, 42, 20, 'Section 1.2', '2025-06-25 13:23:09', '2025-06-25 13:23:09'),
(60, 42, 17, 'Section 3', '2025-06-25 13:23:09', '2025-06-25 13:23:09'),
(61, 43, 10, 'Problem Statement, High-Level Mitigation Approach', '2025-07-14 13:12:39', '2025-07-14 13:12:39'),
(62, 43, 17, 'Variant #1.1 and #1.2 attacks: “Bounds Check Bypass Store”', '2025-07-14 13:12:39', '2025-07-14 13:12:39'),
(63, 43, 20, 'Variant #1.1 and #1.2 attacks: “Bounds Check Bypass Store”', '2025-07-14 13:12:39', '2025-07-14 13:12:39'),
(64, 43, 11, 'Indirect Branches, Calls, and Returns', '2025-07-14 13:12:39', '2025-07-14 13:12:39'),
(65, 47, 21, 'Section 5, Section 6', '2025-07-16 14:44:33', '2025-07-16 14:44:33'),
(66, 47, 11, 'Section 2', '2025-07-16 15:03:34', '2025-07-16 15:03:34'),
(67, 49, 11, 'Section 2', '2025-07-17 10:55:39', '2025-07-17 10:55:39'),
(68, 45, 16, 'Section 6', '2025-07-18 07:33:50', '2025-07-18 07:33:50'),
(69, 50, 11, 'Section 7.2', '2025-07-18 13:16:47', '2025-08-13 09:28:25'),
(70, 53, 22, 'Section \"Discovery\"', '2025-08-05 10:32:00', '2025-08-05 10:33:07'),
(71, 64, 12, 'Overview', '2025-08-13 08:24:30', '2025-08-13 08:24:30');
-- --------------------------------------------------------
--
-- Table structure for table `document_describes_defense`
--
CREATE TABLE `document_describes_defense` (
`id` int(11) NOT NULL,
`document_id` int(11) NOT NULL,
`defense_id` int(11) NOT NULL,
`section` text DEFAULT NULL,
`created` timestamp NOT NULL DEFAULT current_timestamp(),
`updated` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci;
--
-- Dumping data for table `document_describes_defense`
--
INSERT INTO `document_describes_defense` (`id`, `document_id`, `defense_id`, `section`, `created`, `updated`) VALUES
(1, 1, 1, 'Section 5', '2025-06-02 13:28:20', '2025-06-12 14:36:04'),
(2, 2, 3, 'Section 6.4', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(3, 2, 4, 'Section 6.4', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(4, 2, 5, 'Section 6.4', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(5, 10, 3, 'Section 8.2', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(6, 10, 6, 'Section 8.2', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(7, 15, 7, 'Section 4', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(8, 10, 7, 'Section 8.2', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(9, 10, 4, 'Section 8.2', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(10, 10, 8, 'Section 8.2', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(11, 10, 9, 'Section 8.3', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(12, 11, 3, 'Section 7', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(13, 11, 1, 'Section 7', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(14, 11, 6, 'Section 7', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(15, 11, 9, 'Section 7', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(16, 11, 4, 'Section 7', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(17, 11, 10, 'Section 7', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(18, 11, 11, 'Section 7', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(19, 12, 3, 'Section IX', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(20, 12, 6, 'Section IX', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(21, 13, 12, 'Section VIII', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(22, 13, 14, 'Section VIII.A, Section VIII.D', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(23, 13, 15, 'Section VIII.B, Section VIII.C', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(24, 13, 16, 'Section VIII.D', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(25, 14, 3, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(26, 14, 12, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(27, 14, 17, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(28, 14, 13, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(29, 14, 1, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(30, 14, 18, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(38, 16, 6, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(39, 16, 9, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(40, 16, 20, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(41, 16, 3, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(42, 16, 19, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(43, 16, 4, 'Section 8', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(44, 4, 21, 'Section VII.A', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(45, 4, 22, 'Section VII.A', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(46, 4, 14, 'Section VII.B', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(47, 4, 23, 'Section VII.B', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(48, 4, 24, 'Section VII.B', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(49, 4, 25, 'Section VII.C', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(50, 4, 8, 'Section VII.D', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(51, 4, 26, 'Section VII.E', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(52, 4, 27, 'Section VII.E', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(53, 4, 28, 'Section VII.E', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(54, 4, 29, 'Section VII.E', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(55, 19, 23, 'Index Masking', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(56, 19, 24, 'Pointer Poisoning', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(57, 19, 8, 'Reducing Timer Precision', '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(58, 17, 26, NULL, '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(59, 25, 8, NULL, '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(60, 28, 8, NULL, '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(61, 24, 14, NULL, '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(62, 29, 22, NULL, '2025-06-02 13:28:20', '2025-06-02 13:28:20'),
(64, 22, 29, NULL, '2025-06-03 13:25:01', '2025-06-03 13:25:01'),
(65, 23, 29, NULL, '2025-06-03 13:41:11', '2025-06-03 13:41:11'),
(66, 21, 27, NULL, '2025-06-03 14:13:13', '2025-06-03 14:13:13'),
(67, 20, 28, NULL, '2025-06-03 14:29:30', '2025-06-03 14:29:30'),
(68, 31, 26, NULL, '2025-06-03 14:46:15', '2025-06-03 14:46:15'),
(69, 31, 27, NULL, '2025-06-03 14:46:15', '2025-06-03 14:46:15'),
(70, 31, 28, NULL, '2025-06-03 14:46:15', '2025-06-03 14:46:15'),
(71, 30, 31, 'Section 9.1', '2025-06-04 13:23:34', '2025-06-04 13:23:34'),
(72, 30, 30, 'Section 9.1', '2025-06-04 13:26:04', '2025-06-04 13:26:04'),
(73, 30, 26, 'Section 9.2', '2025-06-04 13:27:55', '2025-06-04 13:27:55'),
(74, 33, 26, 'Guidance for RSBU', '2025-06-04 14:21:10', '2025-06-05 08:27:00'),
(76, 32, 23, 'Mitigation V1-3', '2025-06-04 15:16:53', '2025-06-04 15:21:58'),
(77, 32, 22, 'Mitigation G-2, Mitigation V1-1, Mitigation G-5', '2025-06-04 15:18:31', '2025-06-06 10:03:51'),
(78, 32, 29, 'Mitigation V2-1', '2025-06-04 15:23:07', '2025-06-04 15:23:07'),
(79, 32, 26, 'Mitigation V2-4', '2025-06-04 15:28:07', '2025-06-04 15:28:07'),
(80, 32, 27, 'Mitigation V2-4', '2025-06-04 15:28:07', '2025-06-04 15:28:07'),
(81, 32, 28, 'Mitigation V2-4', '2025-06-04 15:28:07', '2025-06-04 15:28:07'),
(82, 32, 32, 'Mitigation G-3', '2025-06-04 15:43:35', '2025-06-04 15:43:35'),
(83, 32, 33, 'Mitigation G-4', '2025-06-04 15:43:35', '2025-06-04 15:43:35'),
(84, 32, 34, 'Mitigation V2-3', '2025-06-04 16:06:09', '2025-06-04 16:06:09'),
(85, 32, 35, 'Mitigation V1-2', '2025-06-04 16:15:43', '2025-06-04 16:15:43'),
(86, 33, 30, 'Guidance for RSBU', '2025-06-05 08:15:37', '2025-06-05 08:15:37'),
(87, 32, 36, 'Mitigation V2-2', '2025-06-06 10:07:55', '2025-06-06 10:07:55'),
(88, 37, 36, NULL, '2025-06-06 10:12:00', '2025-06-11 11:20:19'),
(89, 30, 29, 'Section 8', '2025-06-06 12:18:21', '2025-06-06 12:18:21'),
(90, 30, 36, 'Section 8', '2025-06-06 12:18:21', '2025-06-06 12:18:21'),
(91, 36, 29, 'Section 4.1', '2025-06-10 14:20:09', '2025-06-10 14:20:09'),
(92, 36, 36, 'Section 4.1', '2025-06-10 14:20:09', '2025-06-10 14:20:09'),
(93, 36, 27, 'Section 4.2', '2025-06-10 14:20:09', '2025-06-10 14:20:09'),
(94, 36, 26, 'Section 4.2', '2025-06-10 14:20:09', '2025-06-10 14:20:09'),
(95, 36, 28, 'Section 4.2', '2025-06-10 14:20:09', '2025-06-10 14:20:09'),
(96, 36, 37, 'Section 4.1', '2025-06-10 14:31:47', '2025-06-10 14:31:47'),
(97, 36, 38, 'Section 4.2', '2025-06-10 14:40:37', '2025-06-10 14:40:37'),
(98, 36, 39, 'Section 7', '2025-06-10 15:19:53', '2025-06-10 15:19:53'),
(100, 36, 40, 'Section 7', '2025-06-10 15:30:18', '2025-06-10 15:30:18'),
(101, 35, 22, 'Mitigation Recommendations', '2025-06-11 10:43:57', '2025-06-11 10:43:57'),
(102, 35, 26, 'Mitigation Recommendations', '2025-06-11 10:43:57', '2025-06-11 10:43:57'),
(103, 35, 27, 'Mitigation Recommendations', '2025-06-11 10:43:57', '2025-06-11 10:43:57'),
(104, 35, 29, 'Mitigation Recommendations', '2025-06-11 10:43:57', '2025-06-11 10:43:57'),
(105, 35, 32, 'Mitigation Recommendations', '2025-06-11 10:43:57', '2025-06-11 10:43:57'),
(106, 35, 38, 'Additional Hardening Options', '2025-06-11 10:43:57', '2025-06-11 10:43:57'),
(107, 35, 39, 'Mitigation Recommendations', '2025-06-11 10:43:57', '2025-06-11 10:43:57'),
(108, 35, 41, 'Additional Hardening Options', '2025-06-11 10:43:57', '2025-06-11 10:43:57'),
(109, 35, 42, 'Additional Hardening Options', '2025-06-11 10:43:57', '2025-06-11 10:43:57'),
(110, 34, 29, 'Mitigation', '2025-06-11 13:53:16', '2025-06-11 13:53:16'),
(111, 34, 27, 'Mitigation', '2025-06-11 13:53:16', '2025-06-11 13:53:16'),
(112, 34, 26, 'Mitigation', '2025-06-11 13:53:16', '2025-06-11 13:53:16'),
(113, 34, 28, 'Mitigation', '2025-06-11 13:53:16', '2025-06-11 13:53:16'),
(114, 33, 41, 'Updated Guidance for Branch History Injection and Intra-mode Branch Target Injection', '2025-06-11 14:21:48', '2025-06-11 14:21:48'),
(115, 33, 43, 'Updated Guidance for Branch History Injection and Intra-mode Branch Target Injection', '2025-06-11 14:46:48', '2025-06-11 14:46:48'),
(116, 38, 14, 'Variant 2/Software Mitigations', '2025-06-12 12:05:50', '2025-06-12 12:05:50'),
(117, 38, 22, 'Variant 1/Software Mitigations', '2025-06-12 12:05:50', '2025-06-12 12:05:50'),
(118, 38, 37, 'Variant 2/Software Mitigations', '2025-06-12 12:05:50', '2025-06-12 12:05:50'),
(119, 38, 44, 'Variant 2/Software Mitigations', '2025-06-12 12:05:50', '2025-06-12 12:05:50'),
(120, 38, 45, 'Variant 2/Software Mitigations', '2025-06-12 12:05:50', '2025-06-12 12:05:50'),
(121, 38, 46, 'Variant 2/Software Mitigations', '2025-06-12 12:05:50', '2025-06-12 12:05:50'),
(122, 38, 47, 'Variant 3/Software Mitigations', '2025-06-12 12:05:50', '2025-06-12 12:05:50'),
(123, 38, 48, 'Subvariant 3a/Software Mitigations', '2025-06-12 12:05:50', '2025-06-12 12:05:50'),
(124, 38, 49, 'Subvariant 3a/Software Mitigations', '2025-06-12 12:05:50', '2025-06-12 12:05:50'),
(125, 38, 50, 'Variant 4/Software Mitigations', '2025-06-12 12:05:50', '2025-06-12 12:05:50'),
(126, 39, 41, 'CLRBHB', '2025-06-12 13:17:28', '2025-06-12 13:17:28'),
(127, 39, 51, 'FEAT_ECBHB', '2025-06-12 13:20:50', '2025-06-12 13:25:40'),
(128, 39, 6, 'CSV2 Update', '2025-06-12 13:49:56', '2025-06-12 13:49:56'),
(129, 36, 6, 'Section 4.2', '2025-06-12 13:52:23', '2025-06-12 13:52:23'),
(130, 40, 32, 'Section 9', '2025-06-20 15:01:47', '2025-06-20 15:01:47'),
(131, 40, 34, 'Section 9', '2025-06-20 15:01:47', '2025-06-20 15:01:47'),
(132, 41, 8, 'Section 6.1.3', '2025-06-23 13:03:53', '2025-06-23 13:03:53'),
(133, 41, 14, 'Section 6.1.3', '2025-06-23 13:03:53', '2025-06-23 13:03:53'),
(134, 41, 21, 'Section 6.1.1', '2025-06-23 13:03:53', '2025-06-23 13:03:53'),
(135, 41, 22, 'Section 6.1.2', '2025-06-23 13:03:53', '2025-06-23 13:03:53'),
(136, 41, 25, 'Section 6.1.1', '2025-06-23 13:03:53', '2025-06-23 13:03:53'),
(137, 41, 53, 'Section 6.1.1', '2025-06-23 13:03:53', '2025-06-23 13:03:53'),
(138, 41, 54, 'Section 6.1.2', '2025-06-23 13:03:53', '2025-10-09 10:47:12'),
(139, 42, 55, 'Section 3.3.3', '2025-06-27 15:38:23', '2025-06-27 15:38:23'),
(140, 42, 56, 'Section 4.1', '2025-06-27 15:38:23', '2025-06-27 15:38:23'),
(141, 42, 57, 'Section 4.2', '2025-06-27 15:38:23', '2025-06-27 15:38:23'),
(142, 42, 58, 'Section 4.3', '2025-06-27 15:38:23', '2025-06-27 15:38:23'),
(143, 42, 22, 'Section 3.3.1', '2025-06-27 15:47:23', '2025-06-27 15:47:23'),
(144, 42, 23, 'Section 3.3.2', '2025-06-27 15:47:23', '2025-06-27 15:47:23'),
(145, 42, 48, 'Section 2.3', '2025-06-27 15:47:23', '2025-06-27 15:47:23'),
(146, 43, 55, 'High Level Mitigation Approach, Implementation Details', '2025-07-14 13:15:04', '2025-07-14 13:15:04'),
(147, 43, 29, 'Variant #1.1 and #1.2 attacks: “Bounds Check Bypass Store”', '2025-07-14 13:15:04', '2025-07-14 13:15:04'),
(148, 43, 22, 'High-Level Alternative Mitigation Strategies', '2025-07-14 13:15:04', '2025-07-14 13:15:04'),
(149, 44, 32, 'Volume 3A, Section 4.1.3 (\"Paging-Mode Modifiers\")', '2025-07-14 14:25:36', '2025-10-01 11:51:48'),
(150, 44, 33, 'Volume 3A, Section 4.1.3 (\"Paging-Mode Modifiers\")', '2025-07-14 14:25:36', '2025-10-01 11:51:44'),
(151, 47, 59, 'Section 9.2', '2025-07-16 14:59:19', '2025-07-16 14:59:19'),
(152, 47, 29, 'Section 9.1', '2025-07-16 15:05:12', '2025-07-16 15:05:12'),
(153, 47, 42, 'Section 9.1', '2025-07-16 15:06:50', '2025-07-16 15:06:50'),
(154, 47, 26, 'Section 5.2', '2025-07-16 15:10:08', '2025-07-16 15:10:08'),
(155, 47, 60, 'Section 9.1', '2025-07-16 15:16:11', '2025-07-16 15:16:11'),
(156, 49, 60, 'Section 3', '2025-07-17 10:51:45', '2025-07-17 10:51:45'),
(157, 49, 26, 'Section 2.1', '2025-07-17 11:05:21', '2025-07-17 11:05:21'),
(158, 49, 27, 'Section 2.1', '2025-07-17 11:05:21', '2025-07-17 11:05:21'),
(159, 49, 28, 'Section 2.1', '2025-07-17 11:05:21', '2025-07-17 11:05:21'),
(160, 49, 29, 'Section 2.1', '2025-07-17 11:05:21', '2025-07-17 11:05:21'),
(161, 49, 38, 'Section 2.1', '2025-07-17 11:14:00', '2025-07-17 11:14:00'),
(162, 45, 22, 'Section 10', '2025-07-18 12:48:53', '2025-07-18 12:48:53'),
(163, 45, 29, 'Section 10', '2025-07-18 12:59:07', '2025-07-18 12:59:07'),
(164, 45, 38, 'Section 8.1', '2025-07-18 12:59:32', '2025-07-18 12:59:32'),
(165, 45, 39, 'Section 2.4', '2025-07-18 12:59:44', '2025-07-18 12:59:44'),
(166, 45, 41, 'Section 2.4', '2025-07-18 12:59:52', '2025-07-18 12:59:52'),
(167, 45, 42, 'Section 10', '2025-07-18 13:00:01', '2025-07-18 13:00:01'),
(168, 45, 62, 'Section 9', '2025-07-18 13:00:12', '2025-07-18 13:00:12'),
(169, 50, 62, 'Section 4', '2025-07-18 13:17:22', '2025-07-18 13:17:22'),
(170, 53, 63, 'Section \"Solution\"', '2025-08-05 10:32:30', '2025-08-05 10:32:30'),
(171, 30, 64, 'Section 9.1', '2025-08-07 07:59:17', '2025-08-07 07:59:17'),
(172, 36, 64, 'Section 7', '2025-08-07 08:47:43', '2025-08-07 08:47:43'),
(173, 11, 65, 'Section 7', '2025-08-07 12:53:43', '2025-08-07 12:53:43'),
(174, 12, 66, 'Section IX', '2025-08-07 12:53:43', '2025-08-07 12:53:43'),
(175, 64, 67, 'Speculative Store Bypass Disable (SSBD)', '2025-08-13 08:26:32', '2025-08-13 08:26:32'),
(176, 64, 14, 'Process Isolation', '2025-08-13 08:26:32', '2025-08-13 08:26:32'),
(177, 64, 22, 'Using LFENCE to Control Speculative Load Execution', '2025-08-13 08:26:32', '2025-08-13 08:26:32'),
(178, 30, 28, 'Section 9.1', '2025-08-13 09:26:36', '2025-08-13 09:26:36');
-- --------------------------------------------------------
--
-- Table structure for table `document_describes_defense_implementation`
--
CREATE TABLE `document_describes_defense_implementation` (
`id` int(11) NOT NULL,
`document_id` int(11) NOT NULL,
`defense_implementation_id` int(11) NOT NULL,
`section` varchar(128) DEFAULT NULL,
`created` timestamp NOT NULL DEFAULT current_timestamp(),
`updated` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci;
--
-- Dumping data for table `document_describes_defense_implementation`
--
INSERT INTO `document_describes_defense_implementation` (`id`, `document_id`, `defense_implementation_id`, `section`, `created`, `updated`) VALUES
(1, 1, 1, 'Section 5', '2025-06-02 13:28:41', '2025-06-02 13:28:41'),
(2, 15, 2, 'Section 5', '2025-06-02 13:28:41', '2025-06-02 13:28:41'),
(3, 10, 3, 'Section 8.3', '2025-06-02 13:28:41', '2025-06-02 13:28:41'),
(4, 17, 4, NULL, '2025-06-02 13:28:41', '2025-06-02 13:28:41'),
(5, 19, 5, 'Reducing Timer Precision', '2025-06-02 13:28:41', '2025-06-02 13:28:41'),