Branchboozle: a side-channel within a hidden pattern history table of modern branch prediction units

We present Branchboozle, a side-channel that can be configured on top of a hidden Pattern History Table (PHT) now found in modern Branch Prediction Units (BPUs). In a similar fashion to known BranchScope attacks, Branchboozle works by closely monitoring the directional predictions issued by the BPU, i.e., whether a branch is predicted Taken or Non-Taken. However, our attack exclusively focuses on analyzing the predictions issued by a secondary, mostly-undocumented 3-bit PHT, whereas BranchScope attacks manipulate the predictions issued by a textbook-like 2-bit PHT. This work describes how Branchboozle can configure an extremely robust covert-channel among independent processes that works even across the physical threads of an execution core with Simultaneous Multi-Threading technology. Additionally, we demonstrate that branches protected by Intel's Software Guard eXtensions are also vulnerable to our attack setting. Finally, we illustrate how Branchboozle can potentiate transient execution attacks dependent on branch direction misprediction, i.e., Spectre Variant 1.