Relief for retpoline pain
Relief for retpoline pain
Posted Dec 15, 2018 9:35 UTC (Sat) by ibukanov (subscriber, #3942)In reply to: Relief for retpoline pain by patrakov
Parent article: Relief for retpoline pain
The branch predictor for indirect call is shared and unrelated processes can make it to speculate to jump to an arbitrary address. The conditional direct jumps as used by the if statements can only jump to the wrong branch of the if. The exploit is possible only when the code uses a particular not so frequent pattern and the defense when necessary does not cost as much as trampolines.
