Modern processors are fast, in part, because they guess. Rather than waiting to find out which way a program will branch, a chip predicts the likely path and races ahead. When the guess is right, time is saved. When it's wrong, the work is discarded, but traces of it linger. Since the Spectre vulnerability was disclosed in 2018, attackers have known how to read those traces to pull secrets out of memory they should never see. Chipmakers and operating system developers have spent years building defenses. A new study from MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) shows that a key assumption behind many of them doesn't hold. The defenses work by wiping or isolating the processor's prediction machinery, removing anything an attacker might have planted. The catch, as PhD student Daniel Trujillo and MIT Assistant Professor Mengjia Yan point out, is that the wipe and the moment the predictions get used can't happen at the same instant. There is always a gap '...
learn more
