MIPSBLEED: Uncovering Microarchitectural Timing Leaks in Pervasive Embedded Processors
For security researchers and embedded system designers, it reveals that MIPS processors, despite being legacy, are vulnerable to side-channel attacks, highlighting the need for isolation mechanisms in SMT-enabled embedded systems.
The paper exposes microarchitectural timing leaks in MIPS processors with SMT, demonstrating practical attacks on L1 caches and execution engine, achieving single-trace key recovery on an ECC toolkit.
Despite their age, MIPS processors remain deeply embedded in routers, industrial controllers, and IoT systems, yet their security against modern side-channel attacks has received little attention. This paper exposes how Simultaneous Multithreading (SMT), a feature increasingly used to boost performance in these environments, creates powerful cross-core timing channels on MIPS-based platforms. We introduce MIPSBLEED, a systematic analysis and exploitation framework that uncovers leakage in three shared microarchitectural components: the L1 data cache, L1 instruction cache, and the execution engine. Through carefully crafted assembly-level probes and quantitative leakage assessment, we demonstrate practical, high-resolution timing attacks that operate without requiring privileged access. Our evaluation reveals significant information leakage across all three channels and culminates in a single trace key recovery attack on a real elliptic curve cryptographic toolkit. These results position MIPS as an overlooked yet critical target in the study of microarchitectural security and underscore the urgent need for lightweight isolation mechanisms in resource-constrained, SMT-enabled embedded systems.