Undocumented x86 instructions in Intel CPUs that can modify microcode • Hacker News Board

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#141

Post by rvba » Sun, Mar 21, 2021, 8:53 PM UTC

aasasd wrote: post #128

mjg59 wrote: post #43

Earlier quoted context omitted.

Sure, which is why this is useful to researchers. But the access someone needs to your system in order to exploit the ME vulnerabilities is sufficiently extreme that if someone achieves it you probably have other things to worry about.

I suppose one possible scenario is: - Police confiscate your laptop on some bogus pretext, then return it to you saying you're free to go. - You open the laptop and find nothing that shouldn't be there. You wipe it, reinstall the OS and continue using the laptop. - Surprise! The CPU now works for the police, so after some time it installs a rootkit or whatever. Dunno if the microcode is big enough to do this kind of…

You mean NSA and the same, but online?

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#142

Post by justinclift » Mon, Mar 22, 2021, 12:40 AM UTC

fulafel wrote: post #91

justinclift wrote: post #79

Earlier quoted context omitted.

Doesn't seem like that would leave many possibilities... ;)

I guess out of business CPU companies are one easily accessible category.

While true, it's pretty likely their IP was sold to still-in-business companies. ;)

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#143

Post by olliej » Mon, Mar 22, 2021, 6:51 AM UTC

Daho0n wrote: post #61

olliej wrote: post #22

Earlier quoted context omitted.

No more or less so than intel or amd. Or is the problem that the entire implementation is not public? Because even risc5 doesn't require that.

Untrue. There're more documentation on Intel's CPU than Apple provide on an entire M1 laptop.

.. you mean the ARM specifications?

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#144

Post by ungamedplayer » Mon, Mar 22, 2021, 11:45 AM UTC

usr1106 wrote: post #70

monocasa wrote: post #66

Earlier quoted context omitted.

The previous publicly known mechanism required signed updates. This mechanism allows anyone to twiddle the bits.

> This mechanism allows anyone to twiddle the bits. This remained unclear to me. Other comments say the CPU needs to be in red unlocked state, whatever that is. The screenshot shows UEFI. So one could guess the CPU is in such state before the operating system gets loaded. But the operating system typically loads a microcode update, after that the CPU should no longer be in unlocked state. So for "everyone can fiddle…

> So for "everyone can fiddle with the bits", that would require to run a modified bootloader first. Which should not be possible thanks to secure boot.

Can't the bootloader be signed with MOK (machine owner key ?) that may allow this to work ? (Phys access required, no doubt)

Alternatively if the bootloader doesn't load microcode, just prevent the OS from loading microcode and the system will be in the attackable state ?

Re: Undocumented x86 instructions in Intel CPUs that can modify microcode

#145

Post by trasz » Mon, Mar 22, 2021, 12:10 PM UTC

IncRnd wrote: post #117

trasz wrote: post #76

Earlier quoted context omitted.

That’s one of the reasons why operating systems provide a proper CPRNG instead of trusting RDRAND.

How would an OS seed an RNG in the cloud? How would you seed an RNG on a headless server in a VM? What about when that VM is copied, possibly while running, in order to duplicate server functionality? There are vulnerabilities and threats here that your comment does not take into account.

You can use virtio_random.

But really, it's not about operating systems not using RDRAND at all - it's fine to use it as one of the entropy sources; what you don't want to do is use RDRAND directly instead of CPRNG.