4 ms·
> but if you don’t have global variables and memory access, shouldn’t it be possible to cover it with just software? Can you index out of bounds and catch the
by ori_b 7y ago
> but if you don’t have global variables and memory access, shouldn’t it be possible to cover it with just software?
Can you index out of bounds and catch the exception? You're attackable via Spectre. Can you run multiple threads and time operations? You're vulnerable to MDS.
The attacks don't rely on memory unsafety -- they rely on the state of the CPU being changed by doing fairly normal things, while an observer probes the state by doing other fairly normal things.
- andrekandre 7y agothanks for the reply, it’s appreciated! > Can you index out of bounds and catch the exception? You're attackable via Spectre. ah, i see... ok assuming you could never access out of bounds (all arrays must be typed by length) would that still apply? or do you mean any kind of exception handling that can be deterministically invoked? what if a hypothetical safe language had no exceptions? > Can you run multiple threads and time operations? You're vulnerable to MDS. would that more or less depend on wether or not hyper-threading is enabled or not? assuming you can choose which cpu you are using(that is not vulnerable like intel) would that negate needing hardware memory protection when used with a “safe” language? > The attacks don't rely on memory unsafety -- they rely on the state of the CPU being changed by doing fairly normal things, while an observer probes the state by doing other fairly normal things. yes, thanks. i was just wondering what the limits to that re in terms of “safe’ languages vis-a-vis hardware memory protection/os etc...