3 ms·

It's my understanding that Spectre needs to share some address space with the victim, which isn't the case on containers, other than the host address space?

by foota 9y ago

ithkuil 9y ago
You just need a shared cache.
- foota 9y ago
  I'm not understanding, isn't a shared cache exactly the problem here?
  - cthalupa 9y ago
    You can share a cache on a physical CPU without having shared address space. KVM virtual machines making use of Extended Page Tables or Nested Page Tables do not share an address space with their host or other guests, however, they are susceptible to Spectre v2, for example. (This was the PZ PoC for variant 2)
  - ithkuil 9y ago
    yes, I meant that to suffer from spectre you just need a shared cache; it's not necessary to share address space. It follows from what a cache is. You have a large set of numbers (memory addresses) mapping into a smaller set of numbers (cache lines); my necessity there will be a collision. The mapping is deterministic and you can recover information by looking at these clashes. Some intel high end CPUs have a feature called CAT which was designed to avoid that different workloads interfere too much by stomping on each other's cache lines, but I think it's meant mostly as a performance feature not a security feature (although there is some research about how to use it to defend from cache-based side channels, see http://palms.ee.princeton.edu/system/files/CATalyst_vfinal_correct.pdf http://palms.ee.princeton.edu/system/files/CATalyst_vfinal_c... and https://arxiv.org/pdf/1708.09538.pdf https://arxiv.org/pdf/1708.09538.pdf). Another possible approach is to make it harder to predict the mapping between a physical address (or an address delta) and a cache line. I don't know if using a cryptographic-grade mapping for hardware cache would be even remotely feasible nor whether it would actually solve the problem of information leak.

It's my understanding that Spectre needs to share some address space with the victim, which isn't the case on containers, other than the host address space?

by foota 9y ago

It's my understanding that Spectre needs to share some address space with the victim, which isn't the case on containers, other than the host address space?

ithkuil 9y ago

You just need a shared cache.

foota 9y ago
I'm not understanding, isn't a shared cache exactly the problem here?
- cthalupa 9y ago
  You can share a cache on a physical CPU without having shared address space. KVM virtual machines making use of Extended Page Tables or Nested Page Tables do not share an address space with their host or other guests, however, they are susceptible to Spectre v2, for example. (This was the PZ PoC for variant 2)
- ithkuil 9y ago
  yes, I meant that to suffer from spectre you just need a shared cache; it's not necessary to share address space. It follows from what a cache is. You have a large set of numbers (memory addresses) mapping into a smaller set of numbers (cache lines); my necessity there will be a collision. The mapping is deterministic and you can recover information by looking at these clashes. Some intel high end CPUs have a feature called CAT which was designed to avoid that different workloads interfere too much by stomping on each other's cache lines, but I think it's meant mostly as a performance feature not a security feature (although there is some research about how to use it to defend from cache-based side channels, see http://palms.ee.princeton.edu/system/files/CATalyst_vfinal_correct.pdf http://palms.ee.princeton.edu/system/files/CATalyst_vfinal_c... and https://arxiv.org/pdf/1708.09538.pdf https://arxiv.org/pdf/1708.09538.pdf). Another possible approach is to make it harder to predict the mapping between a physical address (or an address delta) and a cache line. I don't know if using a cryptographic-grade mapping for hardware cache would be even remotely feasible nor whether it would actually solve the problem of information leak.