[MODERATED] Re: spectrev1+

[Jiri Kosina <jkosina@suse.com>]

On Thu, 31 May 2018, speck for Josh Poimboeuf wrote:

> My (probably wrong) understanding is that the pattern is something like
> this:
> 
> if (user_index < array_len) {
> 	bar[user_index] = blah;
> 	...
> 	foo = bar[user_index];
> }
> 
> Do you have a different understanding?

So it's probably too late here now, so I might be missing something 
obvious, but where in the scenario above is the cache-timing-susceptible 
sidechannel? The only cacheline that'd be populated is the bar[user_index] 
one, but that by itself doesn't really reveal any secrets, as there is no 
load from address that'd depend on that potentially malicious value (blah 
is not user-controlled here I guess?).

-- 
Jiri Kosina
SUSE Labs