4 ms·

Didn't spectre work cross-address-space ? I mean the whole point of the spectre vulnerability was that one process read kernel memory or another process' memory

• lucian1900 7y ago
  That's Meltdown, the Intel bug in memory isolation. Spectre is a CPU cache timing attack to derive data. Cache lines are cleared in between context switches, so it can only affect the same process.
  • monocasa 7y ago
    Cache lines aren't cleared on context switches, and there are Spectre variants that are cross address space. There's even a remote Spectre exploit. https://arxiv.org/abs/1807.10535 https://arxiv.org/abs/1807.10535
    • lucian1900 7y ago
      Oh. I entirely misunderstood, then. I stand corrected.
• CalChris 7y ago
  No, it was not cross address space. Actually the kernel was mapped into the high address space of every process (so it was the same address space) and the kernel mapped all of physical memory. So all of physical memory was mapped into every process' logical address space. This was OK because user processes didn't have the privilege to actually read those kernel pages. But Spectre+Meltdown bypassed the privilege enforcement to speculatively read any location and then bled that information back out via a microarchitectural channel. The solution was kernel page table isolation. Don't map the kernel and thus all of physical memory into each process. However, this now has the overhead of mapping and unmapping the kernel pages for each context switch.