Claire Xen  🏳️‍⚧️ 🏳️‍🌈 🧙🏻‍♀️ BLM  🏴 🚩

i wrote this before the names/distinctions were out, but -- meltdown: using this technique to break VM protection (e.g. steal kernel memory)

spectre: harder to exploit, more general, far harder to mitigate: using this technique to steal data *within* a program, e.g. a website's javascript stealing other data in the browser

the distinction here is that spectre *doesn't violate memory protections* and largely involves abusing existing code paths (ROP-style).

I see. That’s more clear. Thanks! I am still a bit confused why spectre can’t be patched w/out hardware architecture changes while meltdown can. These proposed hardware changes basically mean adding security checks prior to speculation right? So slower speeds vs. previous gen?

meltdown: unmap kernel memory before returning to userspace, thereby making speculation impossible. only possible to begin with on chips that allow speculation across privilege boundaries

spectre: there's no memory protection involved so good fxcking luck

Wow. So what does this mean for cpu architecture?

i think the answer is "nobody knows yet"