Contributed by phessler on from the witty-headlines dept.
What the vulnerability does, is with a certain set of pre-conditions, allows an attacker to time how long it takes for the victim process to read memory.
Preconditions: both processes are on the same CPU for the full amount of time of the process, the attacking process gets the first slice of time, and neither is put to sleep, or moved off the CPU. In theory, the attack will work on any two execution cores that share L1 cache memory.
This threat does NOT allow the attacker to read the actual values of memory, just the time it spends.
In OpenBSD in particular, this is downright boring. A very limited set of systems are vulnerable and its a local only attack regardless. There is a limited range of possible attacks, and is massivly more difficult on a real multiuser machine.
(Comments are closed)