Ben Visness, How does Spectre work?
Ben Visness gives an intuitive explanation of Spectre, a class of vulnerabilities that abuse speculative execution, and of what you can do to mitigate it. Speculative execution is there to make programs faster, and modern CPUs all do it.
Speculative execution#
When the CPU has to evaluate a condition, it guesses the outcome and keeps working. A right guess saves time, and a wrong one costs only a small penalty. Out-of-order execution is the related trick of running instructions in a different order from the one they’re written in, since going to memory takes far longer to finish than a comparison or some arithmetic.
Where it goes wrong#
CPUs roll back wrong guesses, just not perfectly. The cache, where data from main memory sits for faster access, doesn’t get rolled back, and Spectre uses what’s left there to extract information that should have stayed secret.
Example#
if (x < array1_size) {
y = array2[array1[x] * 4096];
}
Code like this looks harmless. Speculative loads are real loads that pull main memory into the cache even when the CPU throws the work away later. An attacker can time how fast different memory locations load to find out which of them got touched, and that’s how the information leaks.
A practical exploit#
The article then goes through a more practical exploit with arrays, in which an out-of-bounds access under speculation brings secret data into the cache and the attacker recovers the value. The same technique works across programming languages and platforms, web browsers included.