4 ms·

I see how this addresses some examples of Spectre, and it's clever (hi Filip!) and probably worth doing. However, not all possible Spectre-related vulnerabiliti

by roca 9y ago

I see how this addresses some examples of Spectre, and it's clever (hi Filip!) and probably worth doing. However, not all possible Spectre-related vulnerabilities involve type confusion. E.g. imagine if we had JS code that does let x = bigArray[iframeElem.contentWindow.someProperty]; Conceivably that could get compiled to some mix of JIT code and C++ that does if (iframeElemOrigin == selfDocumentOrigin) { index = ... get someProperty ... x = bigArray[index]; } else { ... error ... } and speculative execution could let the property value leak into the cache. So I'm not optimistic about the prospects for fully automating defenses against Spectre without hardware fixes :-(.

om2 9y ago
We assume no if statements that implement a security check are safe without something. It’s not just bounds checks and type checks. Origin checks are a special case worth considering. I am not sure what you describe would be exploitable in practice (reasons too long to fit in this margin) but worth looking into.
pizlonator 9y ago
Hi Robert! It’s been a while! :-) Oooh that’s a good catch. I agree that pointer poisoning and index masking don’t handle this case. Unless the pointer to the data structure being accessed (bigArray or whatever) is poisoned with a function of origin. Maybe that’s the way to do it. I am still optimistic about this. It’s going to be a lot of work and there will be surprises but then that’s always true when writing software.