At attacker on core 0 wants to steal secrets from a process in core 1 by causing shared cache lines to be flushed while performing precise timing measurements to learn about the neighboring interactions with the cache.
Unfortunately for the attacker, the way different cores alias access in L3 has a complex undocumented mapping.
Unfortunately for the victims, this mapping is static and can be determined by timing probes using cooperating processes.
The page visualizes these mappings.
These results can also aid in rowhammer attacks on dram (where you cause repeated access dram with the intent of corrupting neighboring lines. The normal way to force the memory accesses is to flush the cache, but you can't do that from javascript. Knowing the topology of the cache exactly you could use competing processes on multiple cores to continually flush the cache to get the same effect.
Man these attacks are just so mind blowingly complicated and intricate, and (to be completely honest) kind of beautiful.
I do not envy the engineer that needs to avoid hundreds of these kinds of interactions that can cause security nightmares while still needing to increase performance and reduce power usage when making a new chip.
