5 ms·
Your analogy is more apt for side-channel attacks in general. Here is a more specific version for Meltdown: A library has two rooms, one for general books and
by 314 9y ago
Your analogy is more apt for side-channel attacks in general. Here is a more specific version for Meltdown:
A library has two rooms, one for general books and one for restricted books. The restricted books are not allowed out of the library, and no notes or recordings are allowed to be taken out of the restricted room.
An attacker wants to sneak information out of the restricted room. To do this the pick up a pile of non-restricted books and go into the restricted room. Depending on what they read in there they rearrange the pile of non-restricted books into a particular order. A guard comes along and sees them, they are thrown out of the restricted room and their pile of non-restricted books is put on the issue desk ready to be put back into circulation.
Their conspirator looks at the order of the books on the issue desk and decodes a piece of information about the book in the restricted room. They repeat this process about 500000 times a second until they have transcribed the secret book.
- lma21 9y agoWhat is the analogy behind being able to go into the restricted room?
- foota 9y agoYou can call into the kernel. edit: s/call into/trigger a syscall/
- IshKebab 9y agoYou don't even need to do that for meltdown.
- 314 9y agoThe restricted room is the part of the machine behind the protection. Memory reads are not checked at the tine access. They are checked when the instruction retires.
- AlphaSite 9y agoOn intel* this isn’t a property intrinsic to superscalar processors, other architectures check it in flight or while it’s in the issue queue, preventing this side channel.
- pgt 9y agoI don't understand this explanation :/ Why is the room considered restricted if you can go inside? Do I know how all books that exist in the library? How does the order of the thrown out books pertain to the secret book?
- ohazi 9y ago> Why is the room considered restricted if you can go inside? That's the bug. The guard only checks to see whether you're supposed to have access after you walk in and start (speculatively) rearranging books. One way to fix this bug would be to have the guard check your access at the door.