CacheOut: Leaking Data on Intel CPUs via Cache Evictions
Before people get all nutty as usual:This is another TSX (transactional memory) issue, and you can disable TSX without much of a problem.The attacker basically needs to be running a binary on the machine (not JS in a browser or anything).The leakage is extremely slow, about 225 byte/minute for ASCII text (a 4k page in 18 minutes). I'm not sure if that was an exact recovery either, just a probabilistic one. With noise reduction to enhance recovery, they said it took twice as long - so about 113 byte/minute.It seems to be able to only be able to control the bottom 12-bits of the address to recover (but I didn't fully get why) and require the process to be either reading or writing the data to get it into L1 cache somehow, so just sitting in RAM isn't good enough.attacker still needs to figure out an address (even with ASLR there is still a lot of guessing, and if you have really sensitive data, just move it every second until you wipe it).Interesting, but kind of a non-issue.