5 ms·
It's important that no exploitable paths get missed. An attacker needs only a single vulnerable code pattern, which can be anywhere in a process's address space
by brianpgordon 9y ago
It's important that no exploitable paths get missed. An attacker needs only a single vulnerable code pattern, which can be anywhere in a process's address space (including libraries and other code that have nothing to do with security).
Hmm, I don't understand this statement. My (simplistic) understanding of this attack is that speculative execution produces detectable side-effects that result in memory being leaked from another address space that the attacker isn't supposed to be able to read. Surely if Spectre is used to leak the contents of something useless then that's not going to help the attacker compromise the application. Spectre is read-only, right? Am I missing something?
- foota 9y agoSpectre can be used to leak arbitrary memory from a process iirc. So, if you have a process with nothing interesting it should be fine.
- josteink 9y agoI thought for Intel processors it leaked across all processes, including outside user-space. Or was that meltdown?
- ChrisSD 9y agoMeltdown allows information to leak across ring boundaries. Spectre by itself doesn't. Meltdown is relatively easy to fix whereas Spectre is a more fundamental issue with how most modern chips are designed.
- criddell 9y agoThat's my understanding as well. If you are writing a new Notepad.exe, you probably don't care about Spectre.