Side Channels

An operating system can deny every unauthorized read and still allow information to escape.

Suppose two processes cannot access each other's virtual memory. They may still share a processor core, cache, branch predictor, memory bus, or storage cache. If one process's use of a secret changes the state or timing of a shared resource, another process may be able to measure that effect and infer information.

This is a side channel: an unintended path through which information becomes observable.

The secret is never read directly. It leaks because the computation's side effects differ depending on its value, which is why access control alone does not close this path.

Side channels are fundamentally different from a normal permission failure. The attacker does not ask the kernel to return protected bytes directly. The attacker learns about those bytes from effects produced while the system processes them.

This chapter classifies timing, cache, contention, and speculative-execution channels, distinguishes side from covert channels, compares Spectre and Meltdown, and examines hardware sharing, mitigations, Linux status, design, and empirical validation.