I need to write a simple program that demonstrates a race condition. I picked the Meltdown vulnerability. I want to clarify something. I'm following this explanation https://resources.infosecinstitute.com/topic/race-conditions-exploitation-case-study/
The result of this attack is that the value of PRIVILEGED_VALUE will be revealed with high probability. This is because the Meltdown race condition means that — in parallel with the permissions check — this value will be extracted and used in the calculation BASE+PRIVILEGED_VALUE, and the resulting memory location will be accessed and the data that it is contained is moved to the cache.
This means that, when the attacker attempts to access the range of potential memory addresses, one should be accessed much more quickly than the others. This is because the address BASE+PRIVILEGED_VALUE has been recently accessed and cached, while the others (hopefully) have not been. This makes it possible for the attacker to derive the value of PRIVILEGED_VALUE by identifying the cached memory address and subtracting off the value of BASE.
I don't understand one thing. How can the attacker exploit the fact that he knows the value of the memory location of the privileged data he wants, if he doesn't have enough privileges to see it? What if this data is encrypted?
One more question: how does the computer "know" what is in the cache? Does it keep a variable saying "this cached value corresponds to this query" or something like that? I need to know this for the program I am writing.