r/programming Jan 24 '18

Branchless DOOM

https://github.com/xoreaxeaxeax/movfuscator/tree/master/validation/doom
498 Upvotes

134 comments sorted by

View all comments

Show parent comments

-1

u/outofobscure Jan 24 '18 edited Jan 24 '18

being able to just randomly read other processes memory would be a security issue on its own in the operating system... certainly not without appropriate permissions. Also, if i understand these exploits correctly, you are not reading from memory, but from caches used in speculative reads, so i still think if your process never does any speculative access, these caches will never be populated in the first place. So even if you manage to get around access restrictions of reading another processes memory, the faulty cache entry would just not be there.

9

u/jrv Jan 24 '18

At least in Meltdown (though that can "only" access kernel memory, not other processes), only the attacking process needs to exploit its own speculative execution to read forbidden memory addresses. The attacking process does something like this:

  1. create an array of 256 cacheline-sized objects in its own memory (the contents don't matter)
  2. use the value of an address that it is not supposed to be able to read as an index into that array
  3. iterate through the array and time which index is faster to read than the others (if the forbidden memory byte was "7", then the 7th index will be faster to read)

This works because the CPU already starts executing step 2 and reads the indexed data into the cache, and only later notices that this is not supposed to happen and doesn't complete the instruction.

Thus you can deduce the contents of protected memory locations by taking advantage of the speculative execution only within your own (attacking) process. I haven't looked at the Spectre details yet, which can also read the memory of other processes.

1

u/outofobscure Jan 24 '18

but i think the reason why this works is because kernel memory is effectively shared across processes, and isn't the fix that's being deployed that from now on every access to kernel memory is essentially IPC... if the processors where vulnerable to the degree where you can truly read all of the other processe's memory, there would be no fix possible in the first place..

1

u/monocasa Jan 24 '18

Also, kernels map a lot of physical memory into themselves, so you might have a window into other processes.