safety security
A Shared-Memory Race Replaces the Clock
PhotoFinish turns latency into a stored value across 38 CPUs, showing that removing high-resolution timers does not close every microarchitectural channel.
Summary
PhotoFinish turns latency into a stored value across 38 CPUs, showing that removing high-resolution timers does not close every microarchitectural channel.
Microarchitectural attacks often depend on timing tiny latency differences, so constrained environments commonly restrict precise clocks. PhotoFinish instead races a tested operation against a fixed reference in two threads that write distinct values to one shared location; the winning value exposes the latency relationship without reading or constructing a timer. The authors evaluate 38 CPUs across four instruction-set architectures, classify cache state, reproduce AES T-table and Evict+Reload attacks, and extend the method to TLB and execution-engine latencies. WebAssembly results inside a browser show comparable fidelity in their tests. The finding is a defensive warning: timer restriction alone does not prevent software from observing fine-grained latency when parallel execution and shared memory remain available.
Why it matters
PhotoFinish turns latency into a stored value across 38 CPUs, showing that removing high-resolution timers does not close every microarchitectural channel.
Limits and context
- The finding is a defensive warning: timer restriction alone does not prevent software from observing fine-grained latency when parallel execution and shared memory remain available.
Key claims
PhotoFinish turns latency into a stored value across 38 CPUs, showing that removing high-resolution timers does not close every microarchitectural channel.
Qualification: The finding is a defensive warning: timer restriction alone does not prevent software from observing fine-grained latency when parallel execution and shared memory remain available.
Evidence: source-2026-11-09-004
Sources
- arXiv preprint 2611.09879, original v1arXiv · primary research
Corrections
No corrections have been recorded for this story.