Live data from Hacker News

Zenbleed

lock.cmpxchg8b.com

81–90 of 378 posts

Re: Zenbleed

#81
post #77

Why does disabling SMT not fully prevent this? I don't know the details of Zen 2 architecture, but register files are usually implemented as SRAM on the CPU-die itself. So unless the core is running SMT, I don't understand how another thread could be accessing the register file to write a secret.

Because the context switch only affects architectural state not microarchitectural state.

Yes I understand that but I was struggling to think of a sequence of instructions that would cause this secret leaking on a single thread.

But a simple example is `vzeroupper` followed by anything that writes a secret to the same register file entry would be leaked on a subsequent flush.

Re: Zenbleed

#82
post #51

Really lovely writeup. I liked the discussion of determining how can you tell if a randomly-generated program performed correctly. The obvious approach is to just run it on an "oracle" -- another processor or simulator -- and see if it behaves the same way. But if you're checking for microarchitectural effects with tight timing windows you can also write the same program with various stalls, fences, nops and so on --…

This part was super interesting, especially the differences between fuzzing software and hardware. I also liked the chicken bit.

Re: Zenbleed

#83

This is super cool. This exploit will be one of the canonical examples that just running something in a VM does not mean it's safe. We've always known about VM breakout, but this is a no-breakout massive exploit that is simple to execute and gives big payoffs. Remember: just because this one bug gets fixed in microcode doesn't mean there's not another one of these waiting to be discovered. Many (most?) 0-days are kno…

Yup! I worked at a few companies that would co-mingle Internet facing/DMZ VMs with internal VMs. When pointing this out and recommending we should airgap these VMs to it's own dedicated hypervisor it always fell on deaf ears. Jokes on them I guess.

Re: Zenbleed

#84

Relevant snippet: This technique is CVE-2023-20593 and it works on all Zen 2 class processors, which includes at least the following products: AMD Ryzen 3000 Series Processors AMD Ryzen PRO 3000 Series Processors AMD Ryzen Threadripper 3000 Series Processors AMD Ryzen 4000 Series Processors with Radeon Graphics AMD Ryzen PRO 4000 Series Processors AMD Ryzen 5000 Series Processors with Radeon Graphics AMD Ryzen 7020 S…

So are Ryzen 5000's without Radeon not vulnerable? I guess said processors are zen 3? I have an "AMD Ryzen 9 5950x Desktop Processor" which appears to be Zen 3. I think I'm good? (Not that I'm running untrusted workloads, but yknow, fortune favors the prepared)

You are likely frequently running untrusted workloads. As javascript in a browser. I don't know about this one, but at least meltdown was fully exploitable from js.

But yes, you are fine, 5950x is Zen3.

Re: Zenbleed

#85

This is super cool. This exploit will be one of the canonical examples that just running something in a VM does not mean it's safe. We've always known about VM breakout, but this is a no-breakout massive exploit that is simple to execute and gives big payoffs. Remember: just because this one bug gets fixed in microcode doesn't mean there's not another one of these waiting to be discovered. Many (most?) 0-days are kno…

In the end, I'm thinking most of these are related to branch prediction? It strikes me that it's either that branch prediction is so inherently complex enough it's always going to be vulnerable to this and/or it just so defies the way most of us intuitively think about code paths / instruction execution that it's hard to conceive of the edge cases until too late? At what point does the complexity of CPU architectures…

More generally, most of them are related to speculative execution, where branch mis-prediction is a common gadget to induce speculative mis-execution.

Speculation is hard, it's sort of akin to the idea of introducing multithreading into a program, you are explicitly choosing to tilt at the windmill of pure technical correctness because in a highly concurrent application every error will occur fairly routinely. Speculation is great too, in combination with out-of-order execution it's a multithreading-like boon to overall performance, because now you can resolve several chunks of code in parallel instead of one at a time. It's just also a minefield of correctness issues, but the alternative would be losing something like the equivalent of 10 years of performance gains (going back to like ARM A53 performance).

The recent thing is that "observably correct" needs to include timings. If you can just guess at what the data might be, and the program runs faster if you're correct, that's basically the same thing as reading the data by another means. It's a timing oracle attack.

(in this case AMD just fucked up though, there's no timing attack, this is just implemented wrong and this instruction can speculate against changes that haven't propagated to other parts of the pipeline yet)

The cache is the other problem, modern processors are built with every tenant sharing this single big L3 cache and it turns out that it also needs to be proof against timing attacks for data present in the cache too.

Re: Zenbleed

#86
post #64

Earlier quoted context omitted.

The patch for this exploit is to load AMD's updated microcode.

Is apt update && apt upgrade enough for pop-os users?

Probably eventually yes, but if you are really concerned you need to discuss it with your distro maintainers.

Re: Zenbleed

#87

Relevant snippet: This technique is CVE-2023-20593 and it works on all Zen 2 class processors, which includes at least the following products: AMD Ryzen 3000 Series Processors AMD Ryzen PRO 3000 Series Processors AMD Ryzen Threadripper 3000 Series Processors AMD Ryzen 4000 Series Processors with Radeon Graphics AMD Ryzen PRO 4000 Series Processors AMD Ryzen 5000 Series Processors with Radeon Graphics AMD Ryzen 7020 S…

and how about playstation 5 ?

and also xbox and that thing from valve?

Re: Zenbleed

#88

Earlier quoted context omitted.

So are Ryzen 5000's without Radeon not vulnerable? I guess said processors are zen 3? I have an "AMD Ryzen 9 5950x Desktop Processor" which appears to be Zen 3. I think I'm good? (Not that I'm running untrusted workloads, but yknow, fortune favors the prepared)

You are likely frequently running untrusted workloads. As javascript in a browser. I don't know about this one, but at least meltdown was fully exploitable from js. But yes, you are fine, 5950x is Zen3.

I was under the impression that 5600g and 5600u were Zen3, but being the APU models they have Radeon graphics.

Anecdotally, I tried to reproduce on my 5600g but couldn't. Which is surprising because they claim it works on 5700u...

Edit: just discovered that while my 5600g is Zen3, the 5700u is Zen2. Lol.

Re: Zenbleed

#89
AMD have released an microcode update for affected processors. Your BIOS or Operating System vendor may already have an update available that includes it.

I don’t really understand how CPU microcode updates work. If I’m keeping Ubuntu up to date, will this just happen automatically?

Re: Zenbleed

#90
post #52
post #40

Earlier quoted context omitted.

It is a simple static HTML page, how is it possible in 2023 a static site could be hugged to death. In most cases HN traffic barely hits 100 page view per second.

welp, that's unfortunate indeed. It's a single-core 128 MB VPS, which seemed fine for my boring static html articles. I guess I underestimated the interest.

As an aside, I'd be curious to now how your VPS failed. Memory? Bandwidth?
Post reply on HN