NovFora Dev

In-depth analysis of cross-layer cache pollution vectors and their implications for shared memory subsystems

Jayden Ortiz

Jayden Ortiz

2 months ago

I have been conducting a comprehensive investigation into what I would categorize as an adversarial edge case concerning cross-core cache line invalidation propagation in multi-socket NUMA topologies, specifically focusing on the scenarios where one thread can intentionally trigger L3 evictions across core boundaries via carefully timed atomic writes to shared data structures. The technical mechanism at play here involves MESI protocol transitions — when a write occurs on Core A to a memory address that is cached in Shared state by Cores B through Z, all those copies must be invalidated before the write commits, which incurs the latency of cross-socket interconnect traversal via UPI or Infinity Fabric. If we construct a scenario where an attacker thread rapidly writes to addresses it knows are cached by victim threads on adjacent cores, they can effectively flush the entire working set from the shared L3 cache without ever directly accessing the victim's private data — this is what I am calling 'cross-layer cache pollution.' Now let me detail three distinct edge cases that complicate mitigation strategies. First, the false sharing case: where two threads access unrelated variables on the same 64-byte cache line; a write to variable X invalidates the copy containing variable Y, and in high-frequency loops this can degrade performance by orders of magnitude even without malice. Second, the directory-based coherency bottleneck at scale — as socket counts increase from 2 to 8 or more, the broadcast domain for invalidations grows exponentially unless you implement a hierarchical filter, but those filters themselves introduce their own metadata overhead and attack surface. Third, the non-inclusive L3 cache variant present in some Skylake-SP architectures, where evicting an entry doesn't necessarily invalidate back to L1/L2 — this creates a heterogeneous state space that makes formal verification of security bounds exceedingly difficult. I am currently developing a framework for quantifying cross-core eviction rates per process using PMU

Join the conversation to leave a reply.

Sign in to reply

Related topics