Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zenbleed

lock.cmpxchg8b.com

Post reply on HN
Print view View original

131–140 of 378 posts

Re: Zenbleed

#131

Post by eindiran »

jahsome wrote: post #125
laverya wrote: post #64

Earlier quoted context omitted.

The patch for this exploit is to load AMD's updated microcode.

I'm not sure five year olds know what microcode is. I'm 35, been in tech nearly 20 years and don't recall having heard that specific term before today.

The whole "explain like I'm 5" thing is ridiculous. A huge percentage of topics simply cannot be broken down to an average 5 year old in a way that makes the conversation worth having at all. The 5 year old has no context about why in recent years there has been a huge push towards running your own code on other people's computers using various isolation techniques, or why people are trying to exploit that. The 5 year old has no context for what the exploits actually are, or how to mitigate them. Even if you break all of those things down into 5 year old bitesized chunks, you end up with boring word soup completely disconnected from the meaningful parts of the conversation.

Really what ELI5 is, is a technique to allow the asker to not have to look anything up. From the parent comment, you can look up "patch", "AMD", "microcode"; or you can demand "ELI5!" and have someone else type up long, careful definitions that don't reference context or words that a 5 year old doesn't know.

Regarding what microcode is, here is a good explanation of the differences between microcode and firmware:

https://superuser.com/questions/1283788/what-exactly-is-micr...

Re: Zenbleed

#133

Post by [deleted] »

gabereiser wrote: post #98
CameronNemo wrote: post #86

Earlier quoted context omitted.

Probably eventually yes, but if you are really concerned you need to discuss it with your distro maintainers.

This. Not everyone is as quick as say Arch or Fedora in updating/patching. Please reach out to your maintainers of the distro you use.

[deleted]

Re: Zenbleed

#135

Post by heywhatupboys »

jahsome wrote: post #125
laverya wrote: post #64

Earlier quoted context omitted.

The patch for this exploit is to load AMD's updated microcode.

I'm not sure five year olds know what microcode is. I'm 35, been in tech nearly 20 years and don't recall having heard that specific term before today.

> I'm not sure five year olds know what microcode is

Sounds like cope being outprogrammed by a kindergartner i Roblox

Re: Zenbleed

#136

Post by vladvasiliu »

gabereiser wrote: post #98
CameronNemo wrote: post #86

Earlier quoted context omitted.

Probably eventually yes, but if you are really concerned you need to discuss it with your distro maintainers.

This. Not everyone is as quick as say Arch or Fedora in updating/patching. Please reach out to your maintainers of the distro you use.

Even Arch seems out of date as of 24 jul 2023 17:55 UTC.

The latest amd firmware version is 20230625.

Re: Zenbleed

#137

Post by gavinhoward »

Off-topic question, but can some experts tell me why it is safe for `strlen()` and friends to use vector instructions when they can technically read out of bounds?

Re: Zenbleed

#138

Post by _flux »

winrid wrote: post #118
lopkeny12ko wrote: post #4

Relevant snippet: This technique is CVE-2023-20593 and it works on all Zen 2 class processors, which includes at least the following products: AMD Ryzen 3000 Series Processors AMD Ryzen PRO 3000 Series Processors AMD Ryzen Threadripper 3000 Series Processors AMD Ryzen 4000 Series Processors with Radeon Graphics AMD Ryzen PRO 4000 Series Processors AMD Ryzen 5000 Series Processors with Radeon Graphics AMD Ryzen 7020 S…

Looks like my 2700x narrowly misses this one, assuming 7020 series is affected and not 7000 series.

The wording "at least" suggests the list might not be exhaustive.

Re: Zenbleed

#139

Post by trebligdivad »

0xbadcafebee wrote: post #44

This is super cool. This exploit will be one of the canonical examples that just running something in a VM does not mean it's safe. We've always known about VM breakout, but this is a no-breakout massive exploit that is simple to execute and gives big payoffs. Remember: just because this one bug gets fixed in microcode doesn't mean there's not another one of these waiting to be discovered. Many (most?) 0-days are kno…

The comparison to Meltdown/Spectre are a bit misleading though - they were a whole new form of attack based on timing where the CPU did exactly what it should have done; This zenbleed case is a good old fashioned bug though - data in a register that shouldn't be.

Re: Zenbleed

#140

Post by heywhatupboys »

hinkley wrote: post #121
infinityio wrote: post #116

Earlier quoted context omitted.

It looks like this is a Zen 2-only exploit, so it shouldn't have any impact - AWS are likely already running hardware that isn't vulnerable to this

The way Spectre and Meltdown played out, you'll have to excuse me if I stand outside the blast radius while we figure out if there's a chapter 2, 3 or 4 to this story. They've proven Zen 2 has this problem. They haven't proven no other AMD processors have it. A bunch of people looking to make names for themselves are probably busily testing every other AMD processor for a similar exploit.

> The way Spectre and Meltdown played out, you'll have to excuse me if I stand outside the blast radius while we figure out if there's a chapter 2, 3 or 4 to this story.

I am OOTL on this one, do you have some information you could share?

Post reply on HN