Really lovely writeup. I liked the discussion of determining how can you tell if a randomly-generated program performed correctly. The obvious approach is to just run it on an "oracle" -- another processor or simulator -- and see if it behaves the same way. But if you're checking for microarchitectural effects with tight timing windows you can also write the same program with various stalls, fences, nops and so on -- things which shouldn't affect the output (for single-threaded code) but which will result in the CPU doing significantly different things microarchitecturally. That way the CPU can be its own oracle.
Zenbleed
51–60 of 378 posts
Re: Zenbleed
#52The site is getting hugged to death. https://web.archive.org/web/20230724143835/https://lock.cmpx...
It is a simple static HTML page, how is it possible in 2023 a static site could be hugged to death. In most cases HN traffic barely hits 100 page view per second.
welp, that's unfortunate indeed.
It's a single-core 128 MB VPS, which seemed fine for my boring static html articles. I guess I underestimated the interest.
Re: Zenbleed
#53Re: Zenbleed
#54The site is getting hugged to death. https://web.archive.org/web/20230724143835/https://lock.cmpx...
It is a simple static HTML page, how is it possible in 2023 a static site could be hugged to death. In most cases HN traffic barely hits 100 page view per second.
I imagine they are also getting traffic from sources other than HN.
Re: Zenbleed
#55What does this allow the attacker to do? Steal data? The post isnt very clear.
It is very clear, you just didn't read it. >We now know that basic operations like strlen, memcpy and strcmp will use the vector registers - so we can effectively spy on those operations happening anywhere on the system! It doesn’t matter if they’re happening in other virtual machines, sandboxes, containers, processes, whatever! >This works because the register file is shared by everything on the same physical core.…
Literally the intro says it might contain the root password.
TLDR: The vector registers this bug affects are used for string functions like strcmp, so anything could get loaded into them, including passwords.
Re: Zenbleed
#56Earlier quoted context omitted.
FYI this list isn't exhaustive. And I went to recommend the wikichips link and it's not exhaustive either. https://en.wikichip.org/wiki/amd/microarchitectures/zen_2#Al... Both of them are missing the newer 7000-family products with Zen2 like 7520U etc. https://www.amd.com/en/products/apu/amd-ryzen-5-7520u https://www.amd.com/en/products/apu/amd-ryzen-3-7320u https://www.amd.com/en/products/apu/amd-athlon-gold-7220u
products/apu/amd-athlon Wait... now there's also APU's under the AMD Athlon brand? I know that people are happy when AMD's product offerings are on-par or outperforming Intel, but they didn't have to outdo Intel in the consumer confusion arena as well.
Has been for a while.
https://www.techpowerup.com/cpu-specs/athlon-200ge.c2073
Intel also used the Pentium branding for low-end processors (below i3 and in the Atom lineup), and followed it up with the rather perplexing move of using their company name as the sole branding for their worst products ("Intel Processor").
Re: Zenbleed
#57Earlier quoted context omitted.
It allows the attacker to steal data like e.g. your (root) password.
Only while it's stored unencrypted in memory, right?
My reading of the article was that memory is not directly compromised, but CPU registers. So loaded unencrypted in one of the affected registers.
Re: Zenbleed
#58Relevant snippet: This technique is CVE-2023-20593 and it works on all Zen 2 class processors, which includes at least the following products: AMD Ryzen 3000 Series Processors AMD Ryzen PRO 3000 Series Processors AMD Ryzen Threadripper 3000 Series Processors AMD Ryzen 4000 Series Processors with Radeon Graphics AMD Ryzen PRO 4000 Series Processors AMD Ryzen 5000 Series Processors with Radeon Graphics AMD Ryzen 7020 S…
Do they mean "only confirmed on Zen2", or is the problem definitely confined to only this architecture? Is it likely that this same technique (or similar) also works on earlier (Zen/Zen+) or later (Zen3) cores, but they just haven't been able to demonstrate it yet?
It's Tavis Ormandy, and he reported it to AMD, so one would assume they tried it on related hardware and it's not working.
Re: Zenbleed
#59This is incredibly scary. On my Zen 2 box (Ryzen 3600) logging the output of the exploit running as an unprivileged user while copying and pasting a string into a text editor in the background (I used Kate), resulted in pieces of the string being logged into the output of zenbleed. And this is after a few seconds of runtime mind you, not even a full minute.
Thankfully the exploit is highly dependent on a specific asm routine so exploiting it from JS or WASM in a browser should be extremely difficult. Otherwise a nefarious tab left open for hours in the background could exfiltrate without an issue.
I'm eagerly waiting for Fedora maintainers to push the new microcode so the kernel can update it during the boot process.
Re: Zenbleed
#60Earlier quoted context omitted.
It is a simple static HTML page, how is it possible in 2023 a static site could be hugged to death. In most cases HN traffic barely hits 100 page view per second.
welp, that's unfortunate indeed. It's a single-core 128 MB VPS, which seemed fine for my boring static html articles. I guess I underestimated the interest.
Doesn’t matter, great article!