Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CPU Usage Differences After Applying Meltdown Patch at Epic Games

epicgames.com

Post reply on HN
Print view View original

31–40 of 296 posts

Re: CPU Usage Differences After Applying Meltdown Patch at Epic Games

#31

Post by Matt3o12_ »

angelsl wrote: post #26
Matt3o12_ wrote: post #12

Earlier quoted context omitted.

In case there is a security hole in their Webserver (Apache, Nginx, HAProxy, etc) or their application (Wordpress, etc), that an attack cannot escalate privileges even further. Image someone manages to execute arbitrary PHP code, now they can gain gain root access, read private keys, etc. Things PHP should not have access to. For spectre, the consequences of not applying those patches are not as bad but it wouldn’t s…

Err, what? You can't get root access or escape a chroot from being able to read arbitrary memory.

Yes you can? If password login is enabled, you could wait until someone SSHs in and read their decrypted password. You could read all kinds of secrets which will be very useful for gaining privileged information. Sure you can’t just become root but it is one way to get there.

For my server, the attacker could probably read mosh‘s secret key which is used to authenticate mosh clients. Mosh is a “mobile shell” which allows is resistent toward network changes (including IP changes), is low bandwidth and extremely quick on Eadge connection.

An attacker can probably come up with many solutions where reading arbitary memory can be used to gain root access. Granted the low bandwidth aspect of this attack might make it difficult but far from impossible.

Re: CPU Usage Differences After Applying Meltdown Patch at Epic Games

#32

Post by imjasonmiller »

dannyw wrote: post #3

Surprise, surprise, Intel’s Meltdown patch has significant and serious performance impacts for specific kinds of workloads. All because Intel decided to “optimise” by checking for permissions after speculative retirement, instead of before like AMD.

If, as you say, AMD is not affected by Meltdown unlike Intel, will this significantly change the server market? Excuse the pun, but would this make e.g. AMD EPYC a lot more attractive for such data centers?

Re: CPU Usage Differences After Applying Meltdown Patch at Epic Games

#33

Post by flusteredpie »

ZenoArrow wrote: post #29
aceoflolo wrote: post #19

Earlier quoted context omitted.

What console of the current generation comes with an Intel CPU? And in any case the Meltdown patch is not too bad for games.

> "What console of the current generation comes with an Intel CPU?" The Switch appears to be based on ARM cores that are vulnerable.

Will this aid homebrew communities in their efforts to run unsigned code on the PS4, xbone, Switch et al?

Re: CPU Usage Differences After Applying Meltdown Patch at Epic Games

#34

Post by baq »

angelsl wrote: post #26
Matt3o12_ wrote: post #12

Earlier quoted context omitted.

In case there is a security hole in their Webserver (Apache, Nginx, HAProxy, etc) or their application (Wordpress, etc), that an attack cannot escalate privileges even further. Image someone manages to execute arbitrary PHP code, now they can gain gain root access, read private keys, etc. Things PHP should not have access to. For spectre, the consequences of not applying those patches are not as bad but it wouldn’t s…

Err, what? You can't get root access or escape a chroot from being able to read arbitrary memory.

You don't need anything special to escape a chroot, it's never been intended as a security feature.

Re: CPU Usage Differences After Applying Meltdown Patch at Epic Games

#35

Post by rocqua »

lsd5you wrote: post #4
simooooo wrote: post #2

Wow that's a huge jump. Scared for my web servers now

Not entirely sure why we need to update/protect most servers, since generally they won't be running untrusted code, right?

The replies are missing something from the original article.

They are running on the cloud, and Meltdown / spectre means that exploits can escape a VM. This means you don't just need to trust your VM, but also any VMs you are sharing the hardware with.

Re: CPU Usage Differences After Applying Meltdown Patch at Epic Games

#36

Post by ZenoArrow »

angelsl wrote: post #26
Matt3o12_ wrote: post #12

Earlier quoted context omitted.

In case there is a security hole in their Webserver (Apache, Nginx, HAProxy, etc) or their application (Wordpress, etc), that an attack cannot escalate privileges even further. Image someone manages to execute arbitrary PHP code, now they can gain gain root access, read private keys, etc. Things PHP should not have access to. For spectre, the consequences of not applying those patches are not as bad but it wouldn’t s…

Err, what? You can't get root access or escape a chroot from being able to read arbitrary memory.

If you can dump the memory holding security certificates, I'd suggest you probably can.

There will be processes outside a users control that run with elevated privileges, attacks that allow you to monitor the setup of these processes could prove risky to the overall security of a system.

Re: CPU Usage Differences After Applying Meltdown Patch at Epic Games

#37

Post by DaiPlusPlus »

angelsl wrote: post #26
Matt3o12_ wrote: post #12

Earlier quoted context omitted.

In case there is a security hole in their Webserver (Apache, Nginx, HAProxy, etc) or their application (Wordpress, etc), that an attack cannot escalate privileges even further. Image someone manages to execute arbitrary PHP code, now they can gain gain root access, read private keys, etc. Things PHP should not have access to. For spectre, the consequences of not applying those patches are not as bad but it wouldn’t s…

Err, what? You can't get root access or escape a chroot from being able to read arbitrary memory.

Launch a chrooted daemon that uses Meltdown to read protected memory to discover when a local console user (presumably root/sudo) logs-in, then read the protected memory of the keyboard input buffer (keyboard interrupt handler? Console buffer?) to grab their password, then mail() it off to your email account and login as root via SSH from the comfort of your own home.

Re: CPU Usage Differences After Applying Meltdown Patch at Epic Games

#38

Post by canpan »

nicolaslem wrote: post #13
rcarmo wrote: post #8

Earlier quoted context omitted.

Console manufacturers don't run unsigned code, so I expect they'll just sit still until the next hardware refresh.

I wouldn't be so sure of that. They at least run Javascript through their web browser.

The Nintendo Switch generally only allows white-listed pages. So the attack vector is pretty small. The other consoles, yes, should be possible. But I think not too many people use their consoles for browsing.

Re: CPU Usage Differences After Applying Meltdown Patch at Epic Games

#40

Post by bhouston »

aceoflolo wrote: post #25
transpostmeta wrote: post #23

Earlier quoted context omitted.

Resolving scalability issues is not as simple as "rent more servers".

For a CPU-bound problem it mostly is as simple as that, yes

Only if the algorithm can be split across multiple machines easily.

Sometimes people assume that you can use local shared memory or something between threads in order to synchronize state. You figure out how many individuals can be on a server at once and then ensure that you can handle that load on a specific machine.

I've seen this type of stuff for game state before because they need to keep everyone in a specific game domain (level or city depending on the type of game) synchronized and be nearly real-time. It can be hard to pull this across different machines without introducing significantly latency, redis or DBs is slow for a FPS shootter.

Not saying this is the case but I can see it could be something like that.

Post reply on HN