Spectre/Meltdown

Question 1

What is Spectre?

Answer 1

A computer exploit/attack used to access blocks of memory you are unauthorised to access.

Question 2

How does Spectre work?

if (x < array1_size) {
y = array2[array1[x] * CACHE_LINE_SIZE];
}

Answer 2

array1_size is uncached; Therefore, the request results in a cache miss, so the result must be read from memory.

A mistrained branch predictor pipeline will predict x < array1_size to be true before the result has returned from memory. Therefore, it will execute the code inside the brackets.

While waiting, array1[x] is a cache hit, so the data is read directly without checking validity. However, if we simply set y to array1[x], when the branch is found to be incorrect, all the data would be squashed, deleting it from y.

Instead, we make y an uncached array, and place it into the array at some point. The data will be squashed, but that index specifically will now be cached. All that is left is to perform a side-channel attack, reading every index until one is found that takes significantly shorter time to fetch than the others.

Question 3

What would happen if array2 was cached in Spectre?

if (x < array1_size) {
y = array2[array1[x] * CACHE_LINE_SIZE];
}

Answer 3

When performing the side-channel attack, all of the indexes would take equal time to fetch, so it would be impossible to infer the nature of the data we had taken.

Question 4

What is Meltdown?

Answer 4

Named as such because it “melts” boundaries between kernel and user memory normally enforced by hardware, it is an computer exploit/attack that exploits out-of-order sequencing and virtual memory paging.

Question 5

How does Meltdown work?

raise_exception();
y = array2[array1[x] * PAGE_SIZE]

Answer 5

We start by raising an exception of some kind; because of out-of-order sequencing, while the computer is waiting for the nature of the exception to be brought forward, it begins the next instruction.

array1[x] is in memory, therefore the validity is not checked. array2[array1[x] * PAGE_SIZE], however, is not in memory and results in a read miss, and so it has to be loaded from disk.

The instruction y = … is the discarded when the exception is finally caught. However, similar to Spectre, that part of the array is left in memory, so a side-channel attack can be used to figure out where the data is.

(This is an example of Meltdown, variant 3)