Transient execution attacks, also known as speculative execution attacks, have drawn much interest in the last few years as they can cause critical data leakage. Since the first disclosure of Spectre and Meltdown attacks in January 2018, a number of new transient execution attack types have been demonstrated targeting different processors. A transient execution attack consists of two main components: transient execution itself and a covert channel that is used to actually exfiltrate the information.Transient execution is a result of the fundamental features of modern processors that are designed to boost performance and efficiency, while covert channels are unintended information leakage channels that result from temporal and spatial sharing of the micro-architectural components. Given the severity of the transient execution attacks, they have motivated computer architects in both industry and academia to rethink the design of the processors and to propose hardware defenses. To help understand the transient execution attacks, this survey summarizes the phases of the attacks and the security boundaries across which the information is leaked in different attacks.This survey further analyzes the causes of transient execution as well as the different types of covert channels and presents a taxonomy of the attacks based on the causes and types. This survey in addition presents metrics for comparing different aspects of the transient execution attacks and uses them to evaluate the feasibility of the different attacks. This survey especially considers both existing attacks and potential new attacks suggested by our analysis. This survey finishes by discussing different mitigations that have so far been proposed at the micro-architecture level and discusses their benefits and limitations.

中文翻译：

---

瞬态执行攻击及其缓解措施的调查

瞬态执行攻击，也称为推测执行攻击，在过去几年中引起了极大的兴趣，因为它们可能导致关键数据泄露。自 2018 年 1 月首次披露 Spectre 和 Meltdown 攻击以来，已经证明了许多新的瞬态执行攻击类型针对不同的处理器。瞬态执行攻击由两个主要部分组成：瞬态执行本身和用于实际泄露信息的隐蔽通道。瞬态执行是现代处理器的基本特征的结果，旨在提高性能和效率，而隐蔽通道是由微架构组件的时间和空间共享导致的意外信息泄漏通道。鉴于瞬态执行攻击的严重性，他们促使工业界和学术界的计算机架构师重新思考处理器的设计并提出硬件防御。为了帮助理解瞬态执行攻击，本次调查总结了攻击的阶段和不同攻击中信息泄露的安全边界。本次调查进一步分析了瞬态执行的原因以及不同类型的隐蔽通道和呈现基于原因和类型的攻击分类。该调查还提供了用于比较瞬态执行攻击的不同方面的指标，并使用它们来评估不同攻击的可行性。该调查特别考虑了我们分析中提出的现有攻击和潜在的新攻击。