3 ms·

But can somebody ELI5 how the remote spectre exploit works? I understand the original spectre exploit. But have no idea how it can be done without code being i

• ithkuil 8y ago
  > without code being involved When you perform a network request you cause code to be executed. The code on the server is designed to respond to the request, in the same way as any local cross-process call responds to a request (including a kernel system call). The key difference is not in the trigger, but in the measurement: measuring cache timing effects is more tricky when you can only interact with the target machine via a relatively high latency (and highly variable latency) channel such as the network. The new attack here shows how this can still be done probabilistically. If you wonder how you can flush the cache over the network (without code involved) the answer is the same ad the answer to this question: why can't spectre be solved by just restricting the ability to issue a cache flush instruction? You can effectively flush the cache by performing more requests that cause other stuff to be loaded in the cache and evicting the parts you want to be evicted.