Re:Meltdown and Spectre with Matt Godbolt [audio]
by dustfinger on Thursday January 18, 2018 @10:46AM
(#16177937)
The white paper for meltdown suggests that it is possible to derandomize ASLR in JavaScript. The reference they give is:
Gras, B., Razavi, K., Bosman, E., Bos, H., And Giuffrida, C. ASLR on the Line: Practical Cache Attacks on the MMU. In NDSS (2017)
You might want to check it out. I intended to over the weekend.
Cheers!
Re:Meltdown and Spectre with Matt Godbolt [audio]
by jnordwick on Thursday January 18, 2018 @10:53AM
(#16178006)
Yeah, but there are more issues than just layout randomization, such as forcing data into L1 cache. Even the native code exploits run locally have a problem with this.
Thanks. I'll look at the paper though to see if this is still some hypothetical issue or more practical.
Re:Meltdown and Spectre with Matt Godbolt [audio]
by ithkuil on Friday January 19, 2018 @03:00AM
(#16184771)
All it takes for data to end up in L1 cache is to access it (even only once)
You don't have to access it in a special way to make it end up in L1.
What you have to do for cache side channel attacks is to force data out of the cache, you can tell when the some other data gets in. This can get quite noisy if there is a lot of contention to the same cache lines.
Also remember that the information leak is not in the contents of the cached data, but in the address being cached.
If Specter and Meltdown aren't exploitable through something like JavaScript, my caring goes down to almost zero.
And all native code proofs of concept seem to rely on data being artificiall pushed into L1 cache repeatedly. Without this, I'm not ever sure a native code exploit is really possible.