3 ms·
How are such cache-timing attacks an issue in statically-compiled chunks of code, given that there is good isolation between the kernel and separate processes?
by bluetomcat 8y ago
How are such cache-timing attacks an issue in statically-compiled chunks of code, given that there is good isolation between the kernel and separate processes? If the malicious code sequence is JIT-generated, then we would be able to leak data from the address space of the host process, but otherwise, leaking data from our own address space seems pointless?
- smaddox 8y agoNot my area of expertise, but based on what I've read, Linux maps part of kernel space into userspace memory in order to reduce the overhead of context switches. Spectre puts all of that memory at risk of being read, even though it is protected memory.
- amluto 8y ago> Linux maps part of kernel space into userspace memory... Kind of. Linux, like every x86 kernel, puts some kernel memory in the userspace page tables. But it’s marked with a bit saying “no userspace access”. Meltdown-affected CPUs don’t do a very good job of respecting that bit. > ...in order to reduce the overhead of context switches. It’s done because it’s required. When a system call happens, for example, the CPU starts executing kernel code. That code must be mapped in memory.
- staticassertion 8y agoWhere can I read more about this? Specifically, which parts of memory are mapped in?
- amluto 8y agoLinux, in arch/x86/mm/pti.c