the catch here is: doing the load puts that data in the cache. so... imagine you're not supposed to be able to know "b" because it's in kernel memory. it'll load b, and then load z[b] to get c. then at some point it will fail and roll back.
-
Show this thread
-
but this will have a side effect: the chunk of memory containing "c" will end up getting loaded into cache. the rollback *isn't total*. it's like the CPU went ahead to the next page of an assignment before it was supposed to, but didn't completely hide that fact.
8 replies 24 retweets 197 likesShow this thread -
and given the right circumstances, you can use this to recover "b", one bit at a time.
4 replies 15 retweets 134 likesShow this thread -
you can now recover arbitrary data from any memory in the system. you win.
2 replies 22 retweets 187 likesShow this thread -
(there's other variants that use branch prediction, etc to apply the approximate same attack. but the core idea is the same: construct a case where the CPU leaves a visible trail of its speculative execution)
1 reply 9 retweets 129 likesShow this thread -
someone who read more of the article than me tell me if i'm wrong tho
10 replies 2 retweets 84 likesShow this thread -
oh, and one last thing: the thing that gets me most about this exploit is it isn't really a single exploit, it's a whole *category* of exploits. verifying that no further attacks exist sounds EXTREMELY hard.
2 replies 90 retweets 380 likesShow this thread -
i kinda get why they had to use such a big software hammer on this: i'd be reaaallllyyy nervous about some clever trick solution purporting to patch up an infinity of tiny holes
3 replies 12 retweets 166 likesShow this thread -
Replying to @FioraAeterna
what i really like is that 'oh yeah we broke the fuck out of KASLR' is just a footnote in one of the papers
2 replies 11 retweets 86 likes -
Replying to @mczub @FioraAeterna
also 'oh yeah we reverse engineered all of haswell's branch predictor, no biggie'
3 replies 35 retweets 187 likes
-
-
Humblebrag of the century (not that you don't deserve it)
0 replies 1 retweet 17 likesThanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.