Reading privileged memory with a side-channel

Re:Reading privileged memory with a side-channel by snowwrestler on Thursday January 04, 2018 @01:07AM (#16068389)

To get you with Spectre, the attacker must be able to run code on your CPU.

This affects browsers with Javascript enabled because your Javascript engine runs foreign code on the CPU. The bad guy puts nasty code in a page, you visit the page, the code executes on your machine--boom.

And it affects public cloud web servers because multiple cloud servers (virtual machines) run on one CPU. So some attacker might be able to jump out of their VM and read your VM's memory.

BUT, on a dedicated hardware web server, there shouldn't be any foreign code running--no foreign VMs, and no browser.

[ Parent | on HN ]

Re:Reading privileged memory with a side-channel by user5994461 on Thursday January 04, 2018 @02:48AM (#16068673)

There are many dedicated servers that are shared across users or clients and were expected to be isolated.

Any user who has access to a system (developers or support or sysadmin) has the ability to read arbitrary memory. The vulnerability can probably be leveraged to privilege escalation or bypass the isolation.

[ Parent | on HN ]

Re:Reading privileged memory with a side-channel by tanilama on Thursday January 04, 2018 @06:11AM (#16069428)

Spectre doesn't let u do cross VM memory reading, Meltdown does, AFAIK. If you want to read other VMs memory, u need to RUN in those VMs yourself and within the right process.

So cloud instance and bare metal ones are equally vulnerable under Spectre: as long as they can transfer their malicious code to your VMs and runs it. Can't really see how bare metal servers mitigate this problem.

[ Parent | on HN ]