News for hackers. Stuff that matters.

A comment on CacheOut: Leaking Data on Intel CPUs via Cache Evictions. Parent comment

Re:CacheOut: Leaking Data on Intel CPUs via Cache Evictions by chaboud on Tuesday January 28, 2020 @01:51AM (#22167054)
"It seems to be able to only be able to control the bottom 12-bits of the address to recover (but I didn't fully get why)"

That looks conspicuously like the load/store port address aliasing size (look up "4K Aliasing"), which can be used to stall data availability while the conflict is resolved. I'll read up on this particular one, but there's a growing family of vulnerabilities with 12-bit address aliasing in their toolbox.

[ Parent | on HN ]
Re:CacheOut: Leaking Data on Intel CPUs via Cache Evictions by labawi on Tuesday January 28, 2020 @06:25AM (#22168365)
Reads data (indirectly) from cache - you can select cache slot.

It is on you to make sure something interesting is in the cache, but if you can make your target execute, 12-bits is fairly good selectivity.

[ Parent | on HN ]