4 ms·
That might not be possible in a single threaded environment like JavaScript.
by ynniv 8y ago
That might not be possible in a single threaded environment like JavaScript.
- Klathmon 8y agoIf that single-threaded process can talk to another process or system, can't it gather or exfiltrate timing information through that channel?
- stefan_ 8y agoIt was until they added background workers. There is a known simple mitigation. Don't JIT random JavaScript, back to interpretation. Of course that means there is no use for V8, which is why it's not in this paper.
- ufo 8y agoInterpreters aren't enough either. If the interpreter contains pieces of code that are vulnerable to spectre then it can still be exploited.
- Klathmon 8y agoV8 has a JIT-free mode now, and it's still pretty damn fast in real world situations. It looks like in synthetic benchmarks they saw up to 80% decrease in performance, but in real-world applications they saw as little as a 6% decrease. https://v8.dev/blog/jitless https://v8.dev/blog/jitless But even an interpreted language can still be vulnerable to Spectre attacks.
- phire 8y agoAn attacker could probably use a remote server and mesure the timing differences between http packets. It doesn't matter if your timing source is high noise with lots of jitter, the attacker can repeat the mesurements over and over again and filter everything out. Even if the attacker can only pull out a few bytes per second, that might be enough to leak something critical like and encryption key or an ASLR offset.
- ufo 8y agoThe original article talks at length about the various timer mitigations the v8 team created, and why they still think they are not sufficient.