I understand that Meltdown can access kernel memory as the programs on Windows at least share the same virtual memory space. We have a patch for this to unmap as much kernel data as possible. Can Meltdown access other processes memory?

But what about Spectre 1/2? What memory can it access? Can it access kernel memory as Meltdown? Can it access other processes memory?


As mentioned briefly in the meltdown paper, modern operating systems just map all physical memory into the kernel virtual address space. This means that for most intent and purposes you can assume access to kernel memory = access to any other processes' memory.

The projectzero blog post shows that specter can be used to access kernel memory.

Variant 1 can read kernel memory by running arbitrary code in kernel mode inside a sandbox(for example with the Berkeley Packet Filter) and then use the vulnerability to access memory outside the sandbox.

Variant 2 can access it because branch prediction works across security context so a branch in user mode can be used to train branch prediction in kernel mode.

  • Didn't know all the other apps are mapped in kernel space. This means meldown/spectre can access any other apps. – user4691 Jan 31 '18 at 19:53
  • This means x86 system are safer than x64 systems? – user4691 Jan 31 '18 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.