Reading privileged memory with a side-channel
Summary: Google Project Zero disclosed that CPU data cache timing can be abused to leak information out of mis-speculated execution, yielding at worst arbitrary virtual memory reads across local security boundaries on certain Intel, AMD and ARM processors. Jann Horn reported the issue to the three vendors on 2017-06-01, and three variants are catalogued: bounds check bypass (CVE-2017-5753), branch target injection (CVE-2017-5715) and rogue data cache load (CVE-2017-5754).
What you should know: Project Zero's proof of concept reads kernel virtual memory at roughly 2000 bytes per second on an Intel Haswell Xeon after about 4 seconds of startup, using the eBPF interpreter or JIT that ships in the kernel and is reachable by normal users - a hardware-level leak that no application patch alone addresses.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-5715CVE-2017-5753CVE-2017-5754
- Related
- Threat Brief: Meltdown and Spectre Vulnerabilities Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026