Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zenbleed

lock.cmpxchg8b.com

Post reply on HN
Print view View original

101–110 of 378 posts

Re: Zenbleed

#101

Post by phendrenad2 »

0xbadcafebee wrote: post #44

This is super cool. This exploit will be one of the canonical examples that just running something in a VM does not mean it's safe. We've always known about VM breakout, but this is a no-breakout massive exploit that is simple to execute and gives big payoffs. Remember: just because this one bug gets fixed in microcode doesn't mean there's not another one of these waiting to be discovered. Many (most?) 0-days are kno…

The problem is, VMs aren't really "Virtual Machines" anymore. You're not parsing opcodes in a big switch statement, you're running instructions on the actual CPU, with a few hardware flags that the CPU says will guarantee no data or instruction overlap. It promises! But that's a hard promise to make in reality.

Re: Zenbleed

#102

Post by loeg »

account42 wrote: post #69
taviso wrote: post #52

Earlier quoted context omitted.

welp, that's unfortunate indeed. It's a single-core 128 MB VPS, which seemed fine for my boring static html articles. I guess I underestimated the interest.

Interesting, do you mind sharing what software you use to serve the static html and what kind of traffic its getting.

  HTTP/1.1 200 OK
  Date: Mon, 24 Jul 2023 17:05:06 GMT
  Server: Apache

Re: Zenbleed

#103

Post by jrmg »

tremon wrote: post #100
jrmg wrote: post #89

AMD have released an microcode update for affected processors. Your BIOS or Operating System vendor may already have an update available that includes it. I don’t really understand how CPU microcode updates work. If I’m keeping Ubuntu up to date, will this just happen automatically?

If you already have the package amd64-microcode installed (highly likely), then yes it will be updated automatically. https://packages.ubuntu.com/search?keywords=amd64-microcode

Great, thanks.

Sort of weirds me out that my OS can just silently update my CPU - I didn’t realize I was giving it that level of control… I guess it’s good vs the alternative of no-one actually updating for exploits like his though.

Re: Zenbleed

#104

Post by astrange »

loeg wrote: post #94
zamadatix wrote: post #79

Earlier quoted context omitted.

In the case of the VM won't registers be wiped when entering/exiting the VM?

The problem is the freed entries in the register file. A VM can, at least, use this bug to read registers from a non-VM thread running on the adjacent SMT/HT of a single physical core. I suspect a VM could also read registers from other processes scheduled on the same SMT/HT.

Are people running multiple untrusted VMs without turning SMT off? Even letting them share caches seems like asking for trouble.

Re: Zenbleed

#105

Post by cratermoon »

This link seems hugged to death, so here's an alternate source: AMD 'Zenbleed' Bug Allows Data Theft From Zen 2 Processors, Patches Coming: https://www.tomshardware.com/news/zenbleed-bug-allows-data-t...>

Re: Zenbleed

#107

Post by loeg »

astrange wrote: post #104
loeg wrote: post #94

Earlier quoted context omitted.

The problem is the freed entries in the register file. A VM can, at least, use this bug to read registers from a non-VM thread running on the adjacent SMT/HT of a single physical core. I suspect a VM could also read registers from other processes scheduled on the same SMT/HT.

Are people running multiple untrusted VMs without turning SMT off? Even letting them share caches seems like asking for trouble.

Someone, somewhere is, of course. I don't know if the hyperscalers do, or not.

Re: Zenbleed

#108

Post by yakubin »

taviso wrote: post #52
ksec wrote: post #40

Earlier quoted context omitted.

It is a simple static HTML page, how is it possible in 2023 a static site could be hugged to death. In most cases HN traffic barely hits 100 page view per second.

welp, that's unfortunate indeed. It's a single-core 128 MB VPS, which seemed fine for my boring static html articles. I guess I underestimated the interest.

FWIW, enabling gzip/zstd compression in your HTTP server could help.

Re: Zenbleed

#109

Post by codedokode »

I don't understand how a microcode update could fix this. I assume microcode is used for slow operations like triginometric functions, and doesn't affect how registers are allocated or renamed. Or does the update simply disables some optimizations using "chicken bits"? And by the way, is there a list of such bits?

Re: Zenbleed

#110

Post by sdht0 »

jrmg wrote: post #89

AMD have released an microcode update for affected processors. Your BIOS or Operating System vendor may already have an update available that includes it. I don’t really understand how CPU microcode updates work. If I’m keeping Ubuntu up to date, will this just happen automatically?

https://www.cyberciti.biz/faq/install-update-intel-microcode...
Post reply on HN