Reading privileged memory with a side-channel

Re:Reading privileged memory with a side-channel by 314 on Thursday January 04, 2018 @07:42AM (#16069898)

Not allow user processes to recover from a SEGV. The attack depends on a signal hander that traps the signal and resumes execution. If this is disabled then the attack will not work. This would affect two types of systems:

1. Badly written code where bugs are being masked by the handler. 2. Any kind of virtualization?

So, for cloud providers it looks like a 30% performance hit, but for the rest of us I would rather have a patch that stops applications handling the SEGV trap.

[ Parent | on HN ]

Re:Reading privileged memory with a side-channel by caf on Thursday January 04, 2018 @08:05AM (#16070026)

The attacks do not rely on recovering from SIGSEGV. The speculated execution that accesses out-of-bounds or beyond privilege level happens in a branch that's predicted-taken but actually not-taken, so the exception never occurs.

[ Parent | on HN ]

Re:Reading privileged memory with a side-channel by 314 on Thursday January 04, 2018 @08:10AM (#16070053)

Ah, ok - then I read the paper wrongly. i’ll go back and have another look.

Edit: yes, I missed the details in section 4.1 when I skimmed through. I’m not familiar with the Kocker paper, but I assume the training looks like this?

for(int i=0 i<n; i++) if(i==n-1) do_probe();

[ Parent | on HN ]