Hacker News new | ask | show | jobs
by arohner 3091 days ago
That link no longer loads for me.

AIUI, Spectre can be used to attack the kernel, only if you can get code running in kernel-space, via, e.g. eBPF.

3 comments

No, you could also find a gadget with ROP techniques. The eBPF thing in the paper was purely due to convenience of exploitation.
I think that's almost but not quite exactly right.

Spectre variant 2 attacks vulnerable indirect jump code patterns that exist in the kernel (or some other process), but doesn't require running the attacker's code.

Spectre variant 1 allows you to infer the contents of memory in the same address space, so that's the one where you'd use eBPF to attack the kernel.

Meltdown (variant 3) if I understand correctly can infer memory contents of other address spaces without relying on any assumptions about the code running in the other address space.

https://security.googleblog.com/2018/01/more-details-about-m...

> That link no longer loads for me.

Oh, right, ycombinator's URL parser is broken. I fixed the link to work around the buggy parser....