3 ms·
Section 2.2.1 states: >"An attacker discovers or causes the creation of ‘confused deputy’ code which allows the attacker to cause speculative operations to rev
by bogomipz 9y ago
Section 2.2.1 states:
>"An attacker discovers or causes the creation of ‘confused deputy’ code which allows the attacker to cause speculative operations to reveal information not normally accessible to the attacker."
Can someone say what ‘confused deputy’ code means here? This is not a term I have ever come across before.
The authors then go on to state:
>"If the attacker can identify an appropriate ‘confused deputy’ in a more privileged level, the attackermay be able to exploit that deputy in order to deduce the contents of memory accessible to that deputy but not to the attacker."
Here the reference is to an "appropriate 'confused deputy.' Are these just weasel words? Can someone shed some light on "confused deputies" and what makes one "appropriate"?
- detaro 9y agohttps://en.wikipedia.org/wiki/Confused_deputy_problem https://en.wikipedia.org/wiki/Confused_deputy_problem That said, I don't think it's good label for what's going on.
- tlb 9y agoIt's sort of victim blaming. The code is wrong for having instructions corresponding to a[*b] anywhere in it, rather than our processor is wrong by speculatively executing them with visible effects.
- fyi1183 9y agoThose visible effects (caches being primed by speculative execution) are desirable in many cases though, so it's misleading to say the processor is wrong.
- bogomipz 9y agoThanks, yes agreed, this sounds like a willfully misplaced label.