00052/spectre-attack-example2018年1月2日 (CVE-2017-5753 和 CVE-2017-5715) "幽灵" Spectre 漏洞利用
January 2, 2018 (CVE-2017-5753 and CVE-2017-5715) "Spectre" exploit example
We place the text "The Magic Words are Squeamish Ossifrage." in memory, and then we attempt to read it using the vulnerability. If the system is vulnerable, you will see the same text on standard output.
In this code, if the compiled instructions in victim_function() execute in strict program order, the function only reads from array1[0..15], because array1 size = 16. However, it is possible for execution time to exceed the read time. The ReadMemoryByte() function makes many training calls to victim_function() so that the branch predictor expects a valid value of x, then calls for an out-of-bounds x. The conditional branch is mispredicted, and subsequent speculative execution reads a secret byte using out-of-bounds x. Then, the predicted code reads from array2[array1[x] * 512], leaking the value of array1[x] into the cache. To complete the attack, a simple flush+probe is used to identify which cache line of array2 is loaded, revealing the memory content. The attack is repeated many times, so even if the target byte was not initially cached, the first iteration brings it into the cache. On an i7 Surface Pro 3, the optimized code reads at approximately 10 KB/s.
