[ruby-core:101185] Re: Spectre Mitigations

The mitigations have been put into place at the OS level [0], it is quite
far "below" the level of scripting languages such as Ruby.

I don't recall which toolchain Ruby is built with, but it is possible to
add toolchain specific annotations to the sources to guard critical
sections on top of that. [1] [2] [3]

[0]: https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html
[1]:
https://www.phoronix.com/scan.php?page=news_item&px=GCC-8-Spectre-Mitigation-Lands
[2]: https://devblogs.microsoft.com/cppblog/spectre-mitigations-in-msvc/
[3]: https://llvm.org/docs/SpeculativeLoadHardening.html

Lee Hambley
http://lee.hambley.name/
[phone]


On Tue, 1 Dec 2020 at 17:05, Amel <[e-mail]> wrote:

> Trusted code can potentially be vulnerable to Spectre attacks, as branch
> prediction on modern processors occurs in all code where there are
> branches. The question is how can I stop security critical branches from
> being executed out-of-order and thus protect my trusted code?
>
> Amel
>
> On 01.12.20 16:44, Chris Seaton wrote:
> > I wouldn’t recommend using Ruby to run in-process untrusted code in the
> first place. Are people doing that?
> >
> > Chris
> >
> >> On 1 Dec 2020, at 15:32, Amel <[e-mail]> wrote:
> >>
> >> Hi there!
> >>
> >> I've already asked this question in the ruby-talk mailing list and it
> was hinted at that ruby-core could be the better place to ask, so here's my
> question.
> >>
> >> Are there any mitigations in Ruby for the Spectre security
> vulnerability? Maybe in the interpreter itself or a function which is
> similar to the lfence-instruction.
> >> If there isn't, are there any mitigations planned?
> >>
> >> Cheers,
> >>
> >> Amel
> >>
> >>
> >> Unsubscribe: <mailto:[e-mail]
> ?subject=unsubscribe>
> >> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>
> >
> > Unsubscribe: <mailto:[e-mail]
> ?subject=unsubscribe>
> > <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>
>
> Unsubscribe: <mailto:[e-mail]?subject=unsubscribe>
> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>
>

Unsubscribe: <mailto:[e-mail]?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>