Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zenbleed

lock.cmpxchg8b.com

Post reply on HN
Print view View original

31–40 of 378 posts

Re: Zenbleed

#31

Post by bananapub »

sounds wrote: post #25
ItsTotallyOn wrote: post #23

What does this allow the attacker to do? Steal data? The post isnt very clear.

Huh. The very first line seems pretty clear: > If you remove the first word from the string "hello world", what should > the result be? This is the story of how we discovered that the answer > could be your root password! Can you please expand on your question?

I assume they meant "what does this do in normal vulnerability discussion terms", I don't know why tavis didn't just say "arbitrary memory read across processes" or whatever.

Re: Zenbleed

#32

Post by beebmam »

ItsTotallyOn wrote: post #23

What does this allow the attacker to do? Steal data? The post isnt very clear.

It is very clear, you just didn't read it.

>We now know that basic operations like strlen, memcpy and strcmp will use the vector registers - so we can effectively spy on those operations happening anywhere on the system! It doesn’t matter if they’re happening in other virtual machines, sandboxes, containers, processes, whatever!

>This works because the register file is shared by everything on the same physical core. In fact, two hyperthreads even share the same physical register file.

>It turns out that mispredicting on purpose is difficult to optimize! It took a bit of work, but I found a variant that can leak about 30 kb per core, per second.

>This is fast enough to monitor encryption keys and passwords as users login!

Re: Zenbleed

#33

Post by ItsTotallyOn »

sounds wrote: post #25
ItsTotallyOn wrote: post #23

What does this allow the attacker to do? Steal data? The post isnt very clear.

Huh. The very first line seems pretty clear: > If you remove the first word from the string "hello world", what should > the result be? This is the story of how we discovered that the answer > could be your root password! Can you please expand on your question?

does it require physical access to the machine?

Re: Zenbleed

#35

Post by paulmd »

gruez wrote: post #5
causi wrote: post #3

AMD Ryzen 5000 Series Processors with Radeon Graphics Does this mean Ryzen CPUs without integrated graphics are fine?

No, it's all Zen 2 CPUs, which include both desktop CPUs (with or without integrated graphics, laptop CPUs, and server CPUs. The reason why the product list is so confusing is that AMD reuses architectures across generations. You'd think that all ryzen 5000 series CPUs have the same microarchitecture, but they don't). It's much easier to consult this list instead: https://en.wikipedia.org/wiki/Zen_2#Products

FYI this list isn't exhaustive. And I went to recommend the wikichips link and it's not exhaustive either.

https://en.wikichip.org/wiki/amd/microarchitectures/zen_2#Al...

Both of them are missing the newer 7000-family products with Zen2 like 7520U etc.

https://www.amd.com/en/products/apu/amd-ryzen-5-7520u

https://www.amd.com/en/products/apu/amd-ryzen-3-7320u

https://www.amd.com/en/products/apu/amd-athlon-gold-7220u

Re: Zenbleed

#36

Post by ls612 »

Night_Thastus wrote: post #7
dtx1 wrote: post #2

> AMD have released an microcode update for affected processors. Your BIOS or Operating System vendor may already have an update available that includes it. Yes, I love flashing BIOS... edit nvm, Microcode can get updated via system updates.

To be fair, flashing the bios isn't nearly as bad on most modern systems. Put the file on a USB drive, plug it in, restart and go into the bios, look for the flashing utility, select the file, done. As long as the machine is on a UPS in case of disaster, everything's accounted for.

My new computer takes a while to POST (z690 with ddr5 smh) so it’s basically been continuously either on or in sleep since I built it 18 months ago and I’ve had an unexpected shutdown due to power loss once in that time according to the Event log. I think the risk of losing power while flashing the bios is very small in real life unless you are stuck in a place with third world electricity infrastructure.

Re: Zenbleed

#37

Post by xmodem »

ItsTotallyOn wrote: post #33
sounds wrote: post #25

Earlier quoted context omitted.

Huh. The very first line seems pretty clear: > If you remove the first word from the string "hello world", what should > the result be? This is the story of how we discovered that the answer > could be your root password! Can you please expand on your question?

does it require physical access to the machine?

No, only the ability to execute arbitrary code in an unprivileged context. Would probably have to be arbitrary x86_64 instructions - Javascript wouldn't cut it for this one.

Re: Zenbleed

#38

Post by sounds »

ItsTotallyOn wrote: post #33
sounds wrote: post #25

Earlier quoted context omitted.

Huh. The very first line seems pretty clear: > If you remove the first word from the string "hello world", what should > the result be? This is the story of how we discovered that the answer > could be your root password! Can you please expand on your question?

does it require physical access to the machine?

I was able to reproduce the vulnerability using javascript on a webpage. Therefore, no.

Re: Zenbleed

#39

Post by kzrdude »

ItsTotallyOn wrote: post #33
sounds wrote: post #25

Earlier quoted context omitted.

Huh. The very first line seems pretty clear: > If you remove the first word from the string "hello world", what should > the result be? This is the story of how we discovered that the answer > could be your root password! Can you please expand on your question?

does it require physical access to the machine?

No, it requires unprivileged arbitrary code execution

Re: Zenbleed

#40

Post by ksec »

sounds wrote: post #13

The site is getting hugged to death. https://web.archive.org/web/20230724143835/https://lock.cmpx...

It is a simple static HTML page, how is it possible in 2023 a static site could be hugged to death. In most cases HN traffic barely hits 100 page view per second.
Post reply on HN