3 ms·
Any branch on attacker-controlled data can be speculatively bypassed. You would have to at the very least recompile all applications to attempt to mitigate the
by contrarian_ 9y ago
Any branch on attacker-controlled data can be speculatively bypassed. You would have to at the very least recompile all applications to attempt to mitigate the two Spectre variants discussed so far.
Unless there is some way to turn off speculation entirely, but that would hurt performance badly.
- orblivion 9y agoSo why are the OSes bothering to patch anything?
- contrarian_ 9y agoThere are (at least) two separate things going on. Meltdown, the flaw exclusive to Intel and some ARM CPUs, is very easy to exploit and is the one being patched by OS vendors. Spectre is a whole other can of worms, on the one hand it's more tricky to exploit, on the other hand there might not be an easy fix and people are speculating (no pun intended) that it will have to be dealt with in hardware.
- pfooti 9y agothe pun is apparently at least part of where the name come from, as it exploits speculative computation
- justrobert 9y agoSpectre works in javascript due to how aggressive the JIT is. Chrome and Firefox are already working on solutions as you cannot exploit the JIT if it generates code that ruins your timing as far as I'm aware. So that solves the problem for most people, but all other environments that allow execution of untrusted code also need to be updated.