The stonework of risky execution possessed a lethal, fatal flaw.
Lin Tao knelt in the center of the chamber, his land-mapper metal pen resting across his open palm. The air was sterile and quiet. But beneath the unrendered floor, the 1.024 MHz clock oscillator continued its steady pulse. Outside, the distant ground-shaking blast of Tie Shan’s hammer strikes rang through the granite foundations once every three minutes.
In classic security research, Lin Tao reviewed mentally, this vulnerability was named Spectre. It exploits the fact that risky execution doesn’t respect privilege boundaries during the risky execution window.
If a program contained a conditional check to ensure an index was within array bounds:
if (index < array1_size) { value = array2[array1[index] * 512]; }
An attacker could train the branch predictor by passing valid, legal indices hundreds of times. The processor learned that the condition was always true.
Then, the attacker passed an out-of-bounds index—an address pointing outside the guest container, deep into host kernel memory.
The CPU, expecting another valid access, speculatively evaluated the if statement as true before the bounds check completed. It speculatively read the out-of-bounds byte from host memory, and used that secret byte as an offset to access a backup probe array.
