3 ms·
Spectre allows one process to extract the memory of another process (assuming certain conditions are met). I would not call that boring.
by pubby 9y ago
Spectre allows one process to extract the memory of another process (assuming certain conditions are met). I would not call that boring.
- zeotroph 9y agoDamn, that is indeed possible. And I thought I understood these conceptually, now I have to read the papers again.
- tux1968 9y agoAs i understand it, you can extract memory from another process by controlling input data to that process. First sending data to train an exploitable branch prediction point for success and then sending data which will use a misprediction to extract some data. The paper sited has an example C program that works within a single process, but sets the stage to show how it could be achieved across process boundaries. C program source: https://pastebin.com/9GSrXhi3 https://pastebin.com/9GSrXhi3
- zeotroph 9y agoThis branch prediction inside a "gadget" needs to be mapped into the address spaces of both attacker and victim (i.e. shared lib). But even if the attacker can get this code to run on both sides and examine the dependent timings to find out underlying values, the victim code can't be tricked to sequentially read-by-speculation all its internal data. Does the instruction cache get poisoned as well on a mispredict and carried over?
- elihu 9y agoThat's Spectre variant 2. Variant 1 is only able to read memory in its own address space.