  Timing-based side or covert channels in processor caches continue to present
a threat to computer systems, and they are the key to many of the recent
Spectre and Meltdown attacks. Based on improvements to an existing three-step
model for cache timing-based attacks, this work presents 88 Strong types of
theoretical timing-based vulnerabilities in processor caches. To understand and
evaluate all possible types of vulnerabilities in processor caches, this work
further presents and implements a new benchmark suite which can be used to test
to which types of cache timing-based attacks a given processor or cache design
is vulnerable. In total, there are 1094 automatically-generated test programs
which cover the 88 theoretical vulnerabilities. The benchmark suite generates
the Cache Timing Vulnerability Score which can be used to evaluate how
vulnerable a specific cache implementation is to different attacks. A smaller
Cache Timing Vulnerability Score means the design is more secure, and the
scores among different machines can be easily compared. Evaluation is conducted
on commodity Intel and AMD processors and shows the differences in processor
implementations can result in different types of attacks that they are
vulnerable to. Beyond testing commodity processors, the benchmarks and the
Cache Timing Vulnerability Score can be used to help designers of new secure
processor caches evaluate their design's susceptibility to cache timing-based
attacks.
