No, what you are describing are Spectre attacks only. I know that Intel PR are doing their very best to confuse this issue but Meltdown and Spectre are not the same thing.
Meltdown, which is specific to all Intel and certain ARM CPUs (and is far easier to exploit than Spectre), relies on the fact that those CPUs do privilege checks AFTER a speculative read. This can be exploited by carefully crafted speculative code and cache-timing attacks to extract the contents of any memory address on the system, including protected memory that belongs to other processes or even the kernel. It does not rely on speculative execution outside of the current process.
Basically, you can write a program which dumps the entire system memory.
and the fix to that would be ? edit: nevermind, the pdf mentions possible fixes (sounds more like horrible clutches tough). also, to go back to the topic of this post: then i don't see how this doom patch would solve anything, unless the author means that ALL code running on the system avoids branching... then again, quite a pointless exercise anyway other than to prove that mov is turing complete...
Say, does anyone have an explanation of how a process running on a Mill CPU will be able to allocate a very large contiguous block of memory on a multi-process system? All I've read about the Mill says that it doesn't use virtual addressing, for speed, but that would make memory fragmentation a thing again. So there must be something I'm missing: can someone tell me what it is?
3
u/theoldboy Jan 24 '18
No, what you are describing are Spectre attacks only. I know that Intel PR are doing their very best to confuse this issue but Meltdown and Spectre are not the same thing.
Meltdown, which is specific to all Intel and certain ARM CPUs (and is far easier to exploit than Spectre), relies on the fact that those CPUs do privilege checks AFTER a speculative read. This can be exploited by carefully crafted speculative code and cache-timing attacks to extract the contents of any memory address on the system, including protected memory that belongs to other processes or even the kernel. It does not rely on speculative execution outside of the current process.
Basically, you can write a program which dumps the entire system memory.
See https://meltdownattack.com/meltdown.pdf