⚠️ Disclaimer: This work was conducted strictly in a controlled, isolated virtual machine for academic and educational purposes. It does not target or affect any production system, and no proprietary exploit code was authored — the publicly available SpectrePoC repository was used for demonstration.

📑 Table of Contents

• What is Spectre Variant 2?
• How the Attack Works
• Lab Environment
• Proof of Concept Walkthrough
• Demo Video
• Mitigation Strategies
• Repository Structure
• References
• Author

🔍 What is Spectre Variant 2?

CVE-2017-5715 is a microprocessor vulnerability that allows an attacker to trick a CPU's branch predictor into executing instructions along an incorrect ("speculative") path. While the CPU correctly discards the results of this misprediction, it fails to fully erase the side effects — most notably, changes to the CPU cache state. These residual cache changes can be measured using timing analysis, allowing an attacker to infer secret data that should never have been accessible.

Unlike traditional software bugs, Spectre exploits the hardware design of modern CPUs, making it extremely difficult to patch completely and requiring a combination of microcode, OS, and compiler-level mitigations.

⚙️ How the Attack Works

1. Mistrain the branch predictor — repeatedly execute a branch in a predictable pattern so the CPU learns to expect it.
2. Trigger a misprediction — force the CPU to speculatively execute a different, attacker-chosen path.
3. Speculative out-of-bounds read — the CPU speculatively accesses memory it shouldn't, pulling secret data into the cache before it realizes the mistake.
4. Rollback & residue — the CPU discards the speculative results, but the cache line touched during speculation remains "warm."
5. Flush + Reload timing attack — the attacker times memory accesses across the cache to detect which line was cached, and therefore recovers the secret byte-by-byte.

🖥️ Lab Environment

🧪 Proof of Concept Walkthrough

1. Environment Setup

2. Identify CPU Vulnerability Status

Linux exposes CPU vulnerability/mitigation status directly through sysfs:

This confirmed the test CPU was vulnerable to spectre_v2, while other related vulnerabilities (Meltdown, L1TF, MDS) were either mitigated or not affected.

3. Execute the PoC

The tool repeatedly reports Success results alongside a confidence "score," derived from cache-timing differences — each successful read represents one leaked byte of otherwise inaccessible memory, reconstructed entirely through the speculative side channel.

4. Analysis

• ✅ Successfully mistrained the branch predictor
• ✅ Speculatively executed unauthorized memory reads
• ✅ Used Flush+Reload timing analysis to reconstruct leaked bytes

🎥 Demo Video

A recorded walkthrough of the full PoC — from environment setup to successful data exfiltration — is included in this repository to visually validate the attack.

▶️ Watch the PoC Demo Video

📁 Update the path above once the video file is added to your repository (e.g. place it in a demo/ or media/ folder and adjust the link accordingly).

🛡️ Mitigation Strategies

• Patch firmware & OS — apply the latest microcode and kernel updates, which include retpoline and other speculation-barrier mitigations.
• Follow vendor guidance — Intel, AMD, and OS vendors publish specific mitigation instructions per CPU generation.
• Enable OS/browser-level protections — site isolation, Indirect Branch Restricted Speculation (IBRS), and similar mitigations reduce cross-boundary leakage.
• Keep endpoint security current — while not a direct fix, up-to-date security tooling helps detect exploitation attempts that pair Spectre with other attack chains.

📂 Repository Structure

📚 References

• crozone. (2023). SpectrePoC. GitHub. https://github.com/crozone/SpectrePoC
• Microsoft. (n.d.). Update to enable mitigation against Spectre, Variant 2.
• Wikipedia. (n.d.). Spectre (security vulnerability). https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)
• Wikipedia. (n.d.). Side-channel attack. https://en.wikipedia.org/wiki/Side-channel_attack
• Wikipedia. (n.d.). Row Hammer. https://en.wikipedia.org/wiki/Row_hammer
• Twingate Team. (2024). What is Row Hammer? How It Works & Examples.

👤 Author

Shivam Bhatt Cybersecurity Post-Graduate Diploma (Honours) — NAIT 🔗 Feel free to connect on LinkedIn or reach out for collaboration on cybersecurity research.

⭐ If you found this research useful, consider starring the repo!