3 ms·
Are you aware of any spectre POC that in JavaScript you can break out of that sandbox and do anything worth while?
by flatiron 7y ago
Are you aware of any spectre POC that in JavaScript you can break out of that sandbox and do anything worth while?
- bcrosby95 7y agoYeah, my understanding is that browsers added mitigations for this sort of stuff - so I'm curious about it too.
- flatiron 7y agoi believe that the browsers fuzz your timings now which is what spectre heavily relied on. i think people thinking JS+Spectre in the wild are misled especially since 99% of people run with mitigations enabled, why would someone try to exploit it on a browser
- titzer 7y agoSpectre does not allow write access to unprivileged memory; you need another exploit for that. Spectre allows read access to essentially all of the containing process's address space. This is enough for just leaking secrets, but can also assist with other vulnerabilities, e.g. reversing address space randomization in order to figure out where to write in memory with the other vulnerability. It makes all write exploits more dangerous.