MIPSBLEED: Uncovering Microarchitectural Timing Leaks in Pervasive Embedded Processors
2026-06-15 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors studied MIPS processors, which are still used in many devices like routers and IoT gadgets, and found they are vulnerable to side-channel attacks when using simultaneous multithreading (SMT). They created a tool called MIPSBLEED that exposes how data leaks through shared parts of the processor such as caches and the execution engine. Their experiments showed attackers could retrieve sensitive information, like cryptographic keys, without needing special access. The authors highlight that MIPS processors have been overlooked in security research and recommend better isolation methods for these systems.
MIPS processorsSimultaneous Multithreading (SMT)side-channel attacksL1 data cacheL1 instruction cacheexecution enginetiming attackselliptic curve cryptographymicroarchitectural security
Authors
Ahmed Najeeb, Billy Bob Brumley
Abstract
Despite their age, MIPS processors remain deeply embedded in routers, industrial controllers, and IoT systems, yet their security against modern side-channel attacks has received little attention. This paper exposes how Simultaneous Multithreading (SMT), a feature increasingly used to boost performance in these environments, creates powerful cross-core timing channels on MIPS-based platforms. We introduce MIPSBLEED, a systematic analysis and exploitation framework that uncovers leakage in three shared microarchitectural components: the L1 data cache, L1 instruction cache, and the execution engine. Through carefully crafted assembly-level probes and quantitative leakage assessment, we demonstrate practical, high-resolution timing attacks that operate without requiring privileged access. Our evaluation reveals significant information leakage across all three channels and culminates in a single trace key recovery attack on a real elliptic curve cryptographic toolkit. These results position MIPS as an overlooked yet critical target in the study of microarchitectural security and underscore the urgent need for lightweight isolation mechanisms in resource-constrained, SMT-enabled embedded systems.