Hi! > >>> If I'm willing to do timing attacks to defeat KASLR... what prevents > >>> me from using CPU caches to do that? > >>> > >> > >> Because it is impossible to get a cache hit on an access to an > >> unmapped address? > > > > Um, no, I don't need to be able to directly access kernel addresses. I > > just put some data in _same place in cache where kernel data would > > go_, then do syscall and look if my data are still cached. Caches > > don't have infinite associativity. > > > > Ah ok. Interesting. > > But how does that leak address bits that are covered by the tag?
Same as leaking any other address bits? Caches are "virtually indexed", and tag does not come into play... Maybe this explains it? https://www.youtube.com/watch?v=9KsnFWejpQg Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
signature.asc
Description: Digital signature
