Re: [patch V4 11/11] Documentation: Add MDS vulnerability documentation

[Thomas Gleixner <tglx@linutronix.de>]

On Mon, 25 Feb 2019, speck for Dave Hansen wrote:

> On 2/22/19 2:24 PM, speck for Thomas Gleixner wrote:
> > +Contrary to other speculation based vulnerabilities the MDS vulnerability
> > +does not allow the attacker to control the memory target address. As a
> > +consequence the attacks are purely sampling based, but as demonstrated with
> > +the TLBleed attack samples can be postprocessed successfully.
> 
> I saw this "sampling-based" terminology in Andi's docs too.  Personally,
> I find it a bit confusing.  I think it's trying to make a distinction
> between attacks that pull data out of memory and attacks that pull data
> out of CPU-internal state that came from somewhere else.  Maybe
> something like:
> 
> 	Other attacks such as Spectre and Meltdown tend to target data
> 	at a specific memory address.  The MDS vulnerability itself can
> 	not be targeted at memory and can only leak memory contents that
> 	have been loaded into the CPU buffers by other means.
> 
> Or, is it trying to make a *timing* argument?

No, the point is that the other attacks target data at a memory address so
it's more targetted in some ways, at least once the attack found something
which looks interesting it can be targetted pretty good.

The MDS attacks just collect the buffer leakage and then try to make sense
out of the leaked data they retrieved. I think sampling describes that
pretty good. Let me think about it.

Thanks,

	tglx