title: How Process can Share array2(the oracle array) in Spectre Attack?
body: <p>In spectre <a href="https://spectreattack.com/spectre.pdf" rel="nofollow noreferrer">paper</a>, the PoC place Victim and Attacker code in same process.</p>
  
  <p>The code is like this:</p>
  
  <pre><code>if (x &lt; array1_size)
    y = array2[ array1[x] * 256 ];
  </code></pre>
  
  <p>So Attacker and victim can use the same <code>array2</code>(because they are in same code, process).</p>
  
  <p>But in real world, Attacker and Victim is separated(they are different process), so they can't share <code>array2</code>.</p>
  
  <p>So here is my question, in this case, How can Attacker measure access time to <code>array2</code>?<br>
  How can Attacker know <code>array2</code>'s address?</p>
  
  <p>I have no idea how to attacker access to <code>array2</code>. What is misunderstood here?</p>