How a researcher hacked his own computer and found 'worst' chip flaw

Re:How a researcher hacked his own computer and found 'worst... by Pxtl on Thursday January 04, 2018 @04:10PM (#16074113)

Ahhh, that's what I missed. I thought the "speculative execution" people were talking about was executing the tricks on the copied data after the illegal read.

But not only that, the entire illegal operation can be fenced behind a speculative execution with a simple "if" branch. And illegal reads happen in that kind of context all the time because (for example) that's how every FOR loop ends.

There's really two places where pipelining and speculative execution are causing this problem - the obvious one where the CPU is allowed to manipulate protected data before everything gets blown away (except cache loads of legal data, hence the problem), but a second one that means that reads of protected data happen all the time in normal branch prediction misses.

When it happens in normal flow, you can't punish it by killing the process. Reading protected memory in a speculative branch isn't some digital "attempted breaking an entering" that you can clamp down hard on, it's totally normal behavior.

I get it now, thanks.

[ Parent | on HN ]

Re:How a researcher hacked his own computer and found 'worst... by bennofs on Thursday January 04, 2018 @07:45PM (#16075526)

The other thing is that it is not necessary to be in the same process for this: you could in theory have one process do the access (which gets killed) and then observe the cache result in another process.

[ Parent | on HN ]

Re:How a researcher hacked his own computer and found 'worst... by Pxtl on Thursday January 04, 2018 @08:04PM (#16075619)

Daaang, I hadn't even thought of that.

[ Parent | on HN ]