Eugnis/spectre-attack
FreeExample of using revealed "Spectre" exploit (CVE-2017-5753 and CVE-2017-5715)
FreeFree tier
About Eugnis/spectre-attack
Spectre Attack is an educational C program that demonstrates the Spectre vulnerability (CVE-2017-5753 and CVE-2017-5715). It exploits speculative execution to leak secret data from memory, bypassing bounds checks. The program trains the branch predictor to mispredict a conditional branch, then uses a flush+probe cache side-channel to recover a secret byte. It targets a known string 'The Magic Words are Squeamish Ossifrage.' and reads it from memory if the system is vulnerable. The code includes build instructions for GCC and Visual Studio, and references the original Spectre paper. It reads approximately 10KB/second on an i7 Surface Pro 3.
Key Features
Demonstrates Spectre variant 1 (bounds check bypass) and variant 2 (branch target injection)
Uses flush+probe cache side-channel to leak memory contents
Includes training of branch predictor for speculative execution
Buildable with GCC (Linux/macOS) and Visual Studio (Windows)
C source code with Makefile for easy compilation
Reads approximately 10KB/second on an i7 Surface Pro 3
Pros & Cons
Pros
- Simple, well-commented C code that clearly illustrates the Spectre attack mechanism
- Includes references to original paper and CVEs for further study
- Cross-platform build support with GCC and Visual Studio
- Lightweight proof-of-concept with minimal dependencies
Cons
- Only demonstrates basic Spectre variants; does not cover newer mitigations or other side-channel attacks
- Requires a vulnerable CPU/hardware to observe the exploit (most modern systems are patched)
- Proof-of-concept only; not a full exploitation or penetration testing tool
- Not actively maintained (last commit may be outdated)
Best For
Educational demonstration of CPU speculative execution vulnerabilitiesSecurity research and understanding of cache side-channel attacksTesting if a system is vulnerable to Spectre
FAQ
What does this example do?
It attempts to read a secret string 'The Magic Words are Squeamish Ossifrage.' from memory using the Spectre exploit. If the system is vulnerable, the text appears in output.
How do I build the program?
Using GCC: run 'gcc -std=c99 Source.c -o spectre.out' or simply 'make'. Using Visual Studio: create a new empty C project and add Source.c, then build.
What CVEs does this cover?
CVE-2017-5753 (bounds check bypass) and CVE-2017-5715 (branch target injection).
How fast does it read memory?
The unoptimized code reads approximately 10KB/second on an i7 Surface Pro 3.