CacheOut: Leaking Data on Intel CPUs via Cache Evictions
Before people get all nutty as usual:<p>This is another TSX (transactional memory) issue, and you can disable TSX without much of a problem.<p>The attacker basically needs to be running a binary on the machine (not JS in a browser or anything).<p>The leakage is extremely slow, about 225 byte/minute for ASCII text (a 4k page in 18 minutes). I'm not sure if that was an exact recovery either, just a probabilistic one. With noise reduction to enhance recovery, they said it took twice as long - so about 113 byte/minute.<p>It seems to be able to only be able to control the bottom 12-bits of the address to recover (but I didn't fully get why) and require the process to be either reading or writing the data to get it into L1 cache somehow, so just sitting in RAM isn't good enough.<p>attacker still needs to figure out an address (even with ASLR there is still a lot of guessing, and if you have really sensitive data, just move it every second until you wipe it).<p>Interesting, but kind of a non-issue.