4 ms·
What does "speculative race condition" mean?
by dataflow 3y ago
What does "speculative race condition" mean?
- sweatypalmer 3y agoI encourage you to research the rabbit hole that is speculative executive and 'spectre' attacks.
- Jerrrry 3y ago"Speculative Execution" is gonna be my boat name. I'll tell people it's a punny triple entendre, leading people to believe I am a wall street hacking guru hit-man.
- dataflow 3y agoI know what speculative execution is and have some understanding of spectre already. What I don't get is what it means to exploit a speculative race condition.
- saagarjha 3y agoSo the thing with speculative attacks is that you can use an invariant that is broken speculatively to leak things. In this case they use a speculative race condition to gain speculative code execution, much like you can use a normal race condition to gain real code execution. Arbitrary speculative code execution can be used to leak data which can be picked up via side channels.
- sweetjuly 3y agoThis is described pretty well in the paper, but briefly: the "race condition" which they exploit happens because the CPU speculatively (and incorrectly) thinks it acquired a lock. Multiple threads being in a critical section can be exploitable and lead to arbitrary read/write and malicious code execution (one case demonstrated in the paper is some random NFC function). The researchers abuse the fact that the critical section can be entered speculatively to gain speculative malicious code execution, which they then use to construct a gadget which leaks arbitrary kernel memory into side channels.
- dataflow 3y agoThank you!