Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meltdown Proof-of-Concept

github.com

Post reply on HN
Print view View original

21–30 of 187 posts

Re: Meltdown Proof-of-Concept

#21

Post by revelation »

K0nserv wrote: post #12
revelation wrote: post #10

The secret program confirms what others have seen, it's not so much "read any physical memory" as "read memory in cache"

> "read any physical memory" as "read memory in cache" You can force values from any memory to affect the cache in a predictable manner which enables you to read all physical memory. See https://news.ycombinator.com/item?id=16108574 or read the paper yourself https://meltdownattack.com/meltdown.pdf

This is from Google Zero on Meltdown:

We believe that this precondition is that the targeted kernel memory is present in the L1D cache.

Not only is L1D tiny, but stuff like prefetch doesn't touch it. So how exactly do you force any memory into L1D cache unless, like in all the examples we have seen, the victim program is pretty much accessing it in a busy loop?

Re: Meltdown Proof-of-Concept

#23

Post by firethief »

john_teller02 wrote: post #4

These two bugs (Meltdown and Spectr) are really very speculative things. It is like when human beings became aware of astroid orbits they thought that earth is in danger of being hit by one. Now that is indeed a theoritical possibility but what are the chances? These two bugs have been existent for 20 years and there is no known exploits of them. In the GitHub demos also they mention that the demos will work only if…

This is literally a PoC. It's too late for the standard "I can't imagine how to exploit this so surely it cannot be done" fallacy. You are looking at an example of how to do it.

Re: Meltdown Proof-of-Concept

#24

Post by CiPHPerCoder »

ehPReth wrote: post #14
runesoerensen wrote: post #3

The Project Zero bug report (with PoCs/timeline) was also made public a few minutes ago https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

I wonder what happened to "This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public." Executive meddling? Edit: Probably the 'extreme circumstances' bit mentioned in https://news.ycombinator.com/item?id=16108434

https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

> Project Member Comment 4 by hawkes@google.com, Aug 7

> Labels: Deadline-Grace

It looks like Ben Hawkes would know the reason why, but I think the speculation that this grace period was done due to the scope and severity of this finding is likely correct.

Re: Meltdown Proof-of-Concept

#25

Post by runesoerensen »

ehPReth wrote: post #17
adjkant wrote: post #15

Earlier quoted context omitted.

I think for a bug this big it is pretty understandable. So far, it seems clear the actions of all involved were in a good spirit of responsible disclosure.

Hmm, wasn't there that Microsoft Windows(?) bug that they derestricted before the patch was out? Memory escapes me at the moment. I thought it somewhat cemented/promoted their adherence to 90 days regardless of patch availability.

Perhaps you're thinking of this bug report https://bugs.chromium.org/p/project-zero/issues/detail?id=11...

Project Zero evaluated and relaxed their disclosure policy after that incident as described here https://googleprojectzero.blogspot.com/2015/02/feedback-and-...

Re: Meltdown Proof-of-Concept

#26

Post by [deleted] »

ehPReth wrote: post #17
adjkant wrote: post #15

Earlier quoted context omitted.

I think for a bug this big it is pretty understandable. So far, it seems clear the actions of all involved were in a good spirit of responsible disclosure.

Hmm, wasn't there that Microsoft Windows(?) bug that they derestricted before the patch was out? Memory escapes me at the moment. I thought it somewhat cemented/promoted their adherence to 90 days regardless of patch availability.

[deleted]

Re: Meltdown Proof-of-Concept

#27

Post by trendia »

Linux 4.15 and the appropriate modules protect against the attack.

To test, set CONFIG_PAGE_TABLE_ISOLATION=y. That is:

    sudo apt-get build-dep linux
    sudo apt-get install gcc-6-plugin-dev libelf-dev libncurses5-dev
    cd /usr/src
    wget https://git.kernel.org/torvalds/t/linux-4.15-rc7.tar.gz
    tar -xvf linux-4.15-rc7.tar.gz
    cd linux-4.15-rc7
    cp /boot/config-`uname -r` .config
    make CONFIG_PAGE_TABLE_ISOLATION=y deb-pkg

Re: Meltdown Proof-of-Concept

#28

Post by andylei »

john_teller02 wrote: post #4

These two bugs (Meltdown and Spectr) are really very speculative things. It is like when human beings became aware of astroid orbits they thought that earth is in danger of being hit by one. Now that is indeed a theoritical possibility but what are the chances? These two bugs have been existent for 20 years and there is no known exploits of them. In the GitHub demos also they mention that the demos will work only if…

> For this demo, you either need the direct physical map offset (e.g. from demo #2)

as in, demo #2 is a working exploit to get this map

Re: Meltdown Proof-of-Concept

#29

Post by ehPReth »

runesoerensen wrote: post #25
ehPReth wrote: post #17

Earlier quoted context omitted.

Hmm, wasn't there that Microsoft Windows(?) bug that they derestricted before the patch was out? Memory escapes me at the moment. I thought it somewhat cemented/promoted their adherence to 90 days regardless of patch availability.

Perhaps you're thinking of this bug report https://bugs.chromium.org/p/project-zero/issues/detail?id=11... Project Zero evaluated and relaxed their disclosure policy after that incident as described here https://googleprojectzero.blogspot.com/2015/02/feedback-and-...

Ah yes.

I see there's some extensions there (maximum of 14 days) but this bug would have probably been covered under "As always, we reserve the right to bring deadlines forwards or backwards based on extreme circumstances."

Thanks!

Re: Meltdown Proof-of-Concept

#30

Post by abritinthebay »

john_teller02 wrote: post #4

These two bugs (Meltdown and Spectr) are really very speculative things. It is like when human beings became aware of astroid orbits they thought that earth is in danger of being hit by one. Now that is indeed a theoritical possibility but what are the chances? These two bugs have been existent for 20 years and there is no known exploits of them. In the GitHub demos also they mention that the demos will work only if…

I think you're being harshly down-voted without people explaining why.

For a start - this is hardly a remote possibility when we already have proof of concepts like the linked repo.

Secondly - your analogy makes no sense. The only way to make it make sense is add that we also know there is an entire spacefaring group of mercenaries whose entire hobby and/or job is deliberately throwing asteroids in Earths general direction.

Post reply on HN