Change Details

(AFAICT. I'm not very well versed on some of this stuff) We use the scribunto extension (aka LuaSandbox php extension) to provide lua scripting on our sites. I believe this uses luajit so that lua runs jit-ed in the same process as php. Additionally (as pointed out by Tim Starling), lua supports a high resolution timer in the form of `os.clock()`. (In fact LuaSandbox overrides the default os.clock() to provide a higher resolution timer). Tim says the precision is 1µs. https://spectreattack.com/spectre.pdf details (among other things) an attack where branch prediction misses could result in out of bounds reads that can than be leaked by a side channel attack on cpu caches. In section 4.3 they give a proof of concept for javascript where the attack was used to read private info in the browser process that js shouldn't have access to, using the fact it was JIT-ed and there was a high resolution timer. So maybe a similar issue might affect our Lua implementation.

(AFAICT. I'm not very well versed on some of this stuff) We use the scribunto extension (aka LuaSandbox php extension) to provide lua scripting on our sites. ~~I believe this uses luajit so that lua runs jit-ed in the same process as php.~~ Additionally (as pointed out by Tim Starling), lua supports a high resolution timer in the form of `os.clock()`. (In fact LuaSandbox overrides the default os.clock() to provide a higher resolution timer). Tim says the precision is 1µs. https://spectreattack.com/spectre.pdf details (among other things) an attack where branch prediction misses could result in out of bounds reads that can than be leaked by a side channel attack on cpu caches. In section 4.3 they give a proof of concept for javascript where the attack was used to read private info in the browser process that js shouldn't have access to, using the fact it was JIT-ed and there was a high resolution timer. So maybe a similar issue might affect our Lua implementation.

(AFAICT. I'm not very well versed on some of this stuff) We use the scribunto extension (aka LuaSandbox php extension) to provide lua scripting on our sites. ~~I believe this uses luajit so that lua runs jit-ed in the same process as php.~~ Additionally (as pointed out by Tim Starling), lua supports a high resolution timer in the form of `os.clock()`. (In fact LuaSandbox overrides the default os.clock() to provide a higher resolution timer). Tim says the precision is 1µs. https://spectreattack.com/spectre.pdf details (among other things) an attack where branch prediction misses could result in out of bounds reads that can than be leaked by a side channel attack on cpu caches. In section 4.3 they give a proof of concept for javascript where the attack was used to read private info in the browser process that js shouldn't have access to, using the fact it was JIT-ed and there was a high resolution timer. So maybe a similar issue might affect our Lua implementation.