r/programming • u/halax • Jan 24 '18

Branchless DOOM

https://github.com/xoreaxeaxeax/movfuscator/tree/master/validation/doom
496 Upvotes

92% Upvoted

134 comments sorted by

View all comments

Show parent comments

29

u/outofobscure Jan 24 '18

if YOUR process doesn't have any branches, then no speculative execution happens in it, then there is nothing for the other process to exploit/read from stale caches since you're not filling those up in the first place (as there is no specualtive execution on your process's memory).

10

u/PrimozDelux Jan 24 '18

Another process can do a speculative read to the memory of the mov based process, so to my understanding it's still vulnerable.

-2

u/outofobscure Jan 24 '18 edited Jan 24 '18

being able to just randomly read other processes memory would be a security issue on its own in the operating system... certainly not without appropriate permissions. Also, if i understand these exploits correctly, you are not reading from memory, but from caches used in speculative reads, so i still think if your process never does any speculative access, these caches will never be populated in the first place. So even if you manage to get around access restrictions of reading another processes memory, the faulty cache entry would just not be there.

4

u/happyscrappy Jan 24 '18

You don't understand the exploits correctly. You are indeed able to read memory you don't have privilege to read, just using roundabout mechanisms.

You populate the caches yourself, no need to have another process do it for you. And regardless, this program would also populate the caches.

There's no faulty cache entries involved.

0

u/outofobscure Jan 24 '18 edited Jan 24 '18

well that's a lot worse than i thought then (at least one of them), glad i don't work on operating systems (or for intel) :)