  Recent transient-execution attacks, such as RIDL, Fallout, and ZombieLoad,
demonstrated that attackers can leak information while it transits through
microarchitectural buffers. Named Microarchitectural Data Sampling (MDS) by
Intel, these attacks are likened to "drinking from the firehose", as the
attacker has little control over what data is observed and from what origin.
Unable to prevent the buffers from leaking, Intel issued countermeasures via
microcode updates that overwrite the buffers when the CPU changes security
domains.
  In this work we present CacheOut, a new microarchitectural attack that is
capable of bypassing Intel's buffer overwrite countermeasures. We observe that
as data is being evicted from the CPU's L1 cache, it is often transferred back
to the leaky CPU buffers where it can be recovered by the attacker. CacheOut
improves over previous MDS attacks by allowing the attacker to choose which
data to leak from the CPU's L1 cache, as well as which part of a cache line to
leak. We demonstrate that CacheOut can leak information across multiple
security boundaries, including those between processes, virtual machines, user
and kernel space, and from SGX enclaves.
