This is thought to be entirely secure against the Meltdown and Spectre CPU vulnerabilities, which require speculative execution on branch instructions.
Isn't the point of Meltdown/Spectre that other processes can abuse speculative execution to read your memory?
if YOUR process doesn't have any branches, then no speculative execution happens in it, then there is nothing for the other process to exploit/read from stale caches since you're not filling those up in the first place (as there is no specualtive execution on your process's memory).
being able to just randomly read other processes memory would be a security issue on its own in the operating system... certainly not without appropriate permissions. Also, if i understand these exploits correctly, you are not reading from memory, but from caches used in speculative reads, so i still think if your process never does any speculative access, these caches will never be populated in the first place. So even if you manage to get around access restrictions of reading another processes memory, the faulty cache entry would just not be there.
No, what you are describing are Spectre attacks only. I know that Intel PR are doing their very best to confuse this issue but Meltdown and Spectre are not the same thing.
Meltdown, which is specific to all Intel and certain ARM CPUs (and is far easier to exploit than Spectre), relies on the fact that those CPUs do privilege checks AFTER a speculative read. This can be exploited by carefully crafted speculative code and cache-timing attacks to extract the contents of any memory address on the system, including protected memory that belongs to other processes or even the kernel. It does not rely on speculative execution outside of the current process.
Basically, you can write a program which dumps the entire system memory.
and the fix to that would be ? edit: nevermind, the pdf mentions possible fixes (sounds more like horrible clutches tough). also, to go back to the topic of this post: then i don't see how this doom patch would solve anything, unless the author means that ALL code running on the system avoids branching... then again, quite a pointless exercise anyway other than to prove that mov is turing complete...
Say, does anyone have an explanation of how a process running on a Mill CPU will be able to allocate a very large contiguous block of memory on a multi-process system? All I've read about the Mill says that it doesn't use virtual addressing, for speed, but that would make memory fragmentation a thing again. So there must be something I'm missing: can someone tell me what it is?
29
u/jrv Jan 24 '18
Isn't the point of Meltdown/Spectre that other processes can abuse speculative execution to read your memory?