Re:Meltdown, aka “Dear Intel, you suck”
by emn13 on Saturday January 06, 2018 @09:59AM
(#16085514)
Spectre is somewhat reasonable; at least some variants are forgivable. Meltdown isn't. The risks due specifically to speculation and cache timing attacks (and lots of related stuff) were well known and documented for over a decade. They shouldn't have been speculating across memory protection boundaries, and they should have known that - even if it was unclear exactly how one might exploit such information leakage.
[ Parent
| on HN ]
Re:Meltdown, aka “Dear Intel, you suck”
by apcragg on Saturday January 06, 2018 @10:22AM
(#16085609)
If it is so well known why has it taken 20 years to be discovered?
I don't know for sure but i'm guessing it's because this is all proprietary stuff, security researchers working on closed source hardware have to to a lot of inference... turn an already difficult theory into practice on an obscured implementation that is substantially harder to reverse engineer than compiled code.
It didn't take 20 years to be discovered; PoC's for variations on this theme were found over 10 years ago.
The details really matter for making an exploit: so the amount of speculation and what gets speculated, how caches work, how good timing is (and how large the difference between cache and memory is) etc.
Merely knowing that the combination of speculation, caching, and timing have the potential to break through memory protection barriers is a far from enough to actually exploit that weakness.
For comparison: it was widely known that sha1 had weaknesses, yet it took many years for somebody to construct two pdfs that actually demonstrate a hash collision.