Re: [tip:x86/pti] x86/retpoline: Fill RSB on context switch for affected CPUs

From: Arjan van de Ven
Date: Mon Jan 15 2018 - 09:42:10 EST



This would means that userspace would see return predictions based
on the values the kernel 'stuffed' into the RSB to fill it.

Potentially this leaks a kernel address to userspace.

KASLR pretty much died in May this year to be honest with the KAISER paper (if not before then)

also with KPTI the address won't have a TLB mapping so it wouldn't
actually be speculated into.