2 ms·
As others have mentioned, the attack requires a local process that has a shared cache, so it would also require a server that has a remote code execution vulner
by deckar01 10y ago
As others have mentioned, the attack requires a local process that has a shared cache, so it would also require a server that has a remote code execution vulnerability.
- vessenes 10y agoMy memory is that there are ways to punch through virtualization that AWS uses and get insight into cache hits/misses of other tenants, but I'm not sure if that applies here. In that world, you just rent some time on a large AWS instance and sit around mucking with the cache timing waiting for another tenant to do some cryptography. I can't find the link to the paper now, but my thoughts went to combining these two immediately -- you can get a local process without remote code execution if you just log onto your shiny new multitenant virtual server.