Both exploit Spectre V2, but in different ways. My takeaway:
Training Solo:
- Enter the kernel (and switch privilege level) and “self train” to mispredict branches to a disclosure gadget, leak memory.
Branch predictor race conditions:
- Enter the kernel while your trained branch predictor updates are still in flight, causing the updates to be associated with the wrong privilege level. Again, use this to redirect a branch in the kernel to a disclosure gadget, leak memory.
Relatedly, this recent paper shows that many manually-removed bounds checks in Rust libraries can be re-introduced with no bottom-line perf regression, depending on the application https://dl.acm.org/doi/10.1145/3485480
if (x.f != null) {
System.out.println(x.f.toString());
}
Apparently NullAway infers that x.f cannot be null inside the branch, so calling x.f.toString() is safe. However, strictly speaking, since field f is not final, it is possible that a different thread would modify it between the test and the call, resulting in a NullPointerException. Have you decided to just ignore such effects of multi-threading?
Hi, good point! Yes, we are deliberately ignoring multithreading, among many other things. We were aiming to catch the NPEs we see most often in practice while keeping the type system relatively simple. Based on our data from the field, I think NPEs due to multithreading and code like the example are fairly rare.
"VW continued to assert to CARB and the EPA that the increased emissions from these vehicles could be attributed to various technical issues and unexpected in-use conditions. VW issued a voluntary recall in December 2014 to address the issue. CARB, in coordination with the EPA, conducted follow up testing of these vehicles [...] to confirm the efficacy of the recall. When the testing showed only a limited benefit to the recall, CARB broadened the testing to pinpoint the exact technical nature of the vehicles' poor performance"
I remember spending half a day at the dealership to deal with this recall, which was required to get my CA registration renewed. Can't believe it was just a BS update that didn't really fix anything. Shocking and extremely disappointing behavior from VW
They proposed a new notion of "software correctness" as an equilibrium in which there is insufficient economic demand for any further bug fixes. Cool to see such a system being built!
