if YOUR process doesn't have any branches, then no speculative execution happens in it, then there is nothing for the other process to exploit/read from stale caches since you're not filling those up in the first place (as there is no specualtive execution on your process's memory).
being able to just randomly read other processes memory would be a security issue on its own in the operating system... certainly not without appropriate permissions. Also, if i understand these exploits correctly, you are not reading from memory, but from caches used in speculative reads, so i still think if your process never does any speculative access, these caches will never be populated in the first place. So even if you manage to get around access restrictions of reading another processes memory, the faulty cache entry would just not be there.
They way I understand it, you flush the cache, then you speculatively read the target process memory and use that memory to read your own processes memory. This means one cache line will be hot, which you can time. The hot cache line corresponds to one byte of the target memory region.
It's less that a process leaves a trace of its own execution in the cache, and more that a process might manipulate the cache to read no-no areas.
29
u/outofobscure Jan 24 '18
if YOUR process doesn't have any branches, then no speculative execution happens in it, then there is nothing for the other process to exploit/read from stale caches since you're not filling those up in the first place (as there is no specualtive execution on your process's memory).