News for hackers. Stuff that matters.

A comment on Intel Issues Updates to Protect Systems from Security Exploits. Parent comment

Re:Intel Issues Updates to Protect Systems from Security Exp... by jandrese on Thursday January 04, 2018 @04:13PM (#16074145)
No it gets you the contents.

The crux is:

array[value_of_kernel_memory_byte] = 1;

So it speculatively indexes into the array by the value stored at that memory address and writes the byte. Then to figure out what the value is you just have to see which element in the array is cached.

[ Parent | on HN ]
Re:Intel Issues Updates to Protect Systems from Security Exp... by MertsA on Friday January 05, 2018 @03:29AM (#16077353)
To elaborate on this, the write to the array isn't what's being read here.

array[value_of_kernel_memory_byte] = 1;

This assignment gets rolled back like it's supposed to. It's when reading the array after the rollback that the exploit measures that a read to array[value_of_kernel_memory_byte] is faster than the rest because that index is already in the cache.

[ Parent | on HN ]