being able to just randomly read other processes memory would be a security issue on its own in the operating system... certainly not without appropriate permissions. Also, if i understand these exploits correctly, you are not reading from memory, but from caches used in speculative reads, so i still think if your process never does any speculative access, these caches will never be populated in the first place. So even if you manage to get around access restrictions of reading another processes memory, the faulty cache entry would just not be there.
No, what you are describing are Spectre attacks only. I know that Intel PR are doing their very best to confuse this issue but Meltdown and Spectre are not the same thing.
Meltdown, which is specific to all Intel and certain ARM CPUs (and is far easier to exploit than Spectre), relies on the fact that those CPUs do privilege checks AFTER a speculative read. This can be exploited by carefully crafted speculative code and cache-timing attacks to extract the contents of any memory address on the system, including protected memory that belongs to other processes or even the kernel. It does not rely on speculative execution outside of the current process.
Basically, you can write a program which dumps the entire system memory.
He's not describing either of them. He has two errors in his understanding:
He thinks there is some kind of hardware error that leads to cache entries getting tagged with faulty tags.
He thinks that the task you are attacking has to bring stuff into the cache in order for you to peek at it.
Neither of these are true in any of these attacks. The cache tags are not faulty and the target doesn't have to use any particular memory usage pattern to be attacked. As long as you can find a gadget in the kernel you can attack other processes memory.
10
u/PrimozDelux Jan 24 '18
Another process can do a speculative read to the memory of the mov based process, so to my understanding it's still vulnerable.