3 ms·
What is the impact of this exactly? If "FP State" just means floating point register values then those rarely contain interesting stuff. If this also affects r
by kanox 8y ago
What is the impact of this exactly? If "FP State" just means floating point register values then those rarely contain interesting stuff.
If this also affects register used for crypto acceleration then it could be used for stuff like leaking browser secrets from javascript, right?
- cperciva 8y ago"FP State" in this case includes MMX and SSE registers; they're handled via the same "lazy context switching" mechanism. Yes, you can steal keys which are being used for AESNI. Leaking secrets via javascript -- I'll be impressed if someone pulls that off. There's a very tight timing window to exploit this before a trap fires and flushes your pipeline, and I doubt you can get the right instructions in there using javascript.
- caf 8y agoCan't you executive the trapping access in a not-taken speculatively-executed branch à la Meltdown?
- cperciva 8y agoSure, but that gives you an even shorter window because the pipeline flushes as soon as the CPU realizes that it mis-speculated.
- caf 8y agoIt is my understanding that you can make that window very long by having the mis-speculated branch depend on a value that has to be loaded from main memory.
- cperciva 8y agoHmm, good point. Yes, that would probably make this much easier to exploit. Unless the CPU does a partial pipeline flush upon realizing that there would be a trap. I don't know -- do Intel CPUs check for exceptions in order?
- caf 8y agoWell, they don't for #PF at least, because that's how Meltdown works - I'm not sure if it works differently for #NM though.
- ndesaulniers 8y agoRarely contain interesting stuff, like parts of AES keys.