An accessible overview of Meltdown and Spectre, Part 2

Summary: Trail of Bits' second post on Meltdown and Spectre describes Spectre Variant 1, which tricks the conditional branch predictor into skipping bounds checks and reading memory via a cache timing side channel, and Variant 2, which abuses the indirect branch predictor and the shared Branch History Buffer to read memory across privilege levels. Spectre affects almost every processor released in the last 25 years, and a Google Project Zero proof of concept showed a guest virtual machine reading hypervisor memory on real processors.
Bottom line: A working proof of concept breaks the isolation cloud providers rely on to separate tenants, and the mitigations carry a performance cost that is certainly not zero and must be paid on top of the Meltdown fixes.

Read the original at Trail of Bits Blog ↗