3 ms·
"It seems to be able to only be able to control the bottom 12-bits of the address to recover (but I didn't fully get why)" That looks conspicuously like the lo
by chaboud 7y ago
"It seems to be able to only be able to control the bottom 12-bits of the address to recover (but I didn't fully get why)"
That looks conspicuously like the load/store port address aliasing size (look up "4K Aliasing"), which can be used to stall data availability while the conflict is resolved. I'll read up on this particular one, but there's a growing family of vulnerabilities with 12-bit address aliasing in their toolbox.
- labawi 7y agoReads data (indirectly) from cache - you can select cache slot. It is on you to make sure something interesting is in the cache, but if you can make your target execute, 12-bits is fairly good selectivity.