XSA-108 Advisory • Hacker News Board

Re: XSA-108 Advisory

#31

Post by trekkin » Wed, Oct 01, 2014, 1:47 PM UTC

sudowhodoido wrote: post #25

joosters wrote: post #14

Earlier quoted context omitted.

This is just FUD and in the usual insulting De Raadt style of communicating. 'barely has correct page protection' is just a way of saying 'has correct page protection, but I want to be really snotty about it'. So, highlighting a non-problem. No-one is claiming that virtualization makes a system magically completely secure, but do people actually believe that it makes it less secure? (Compared to, running the same sof…

Not really. He's right. The memory, paging and protection model for X86 is fugly at best. It's very easy to hang yourself as demonstrated. You can be as insulting as you like if you compare X86 (and X86-64) to SPARC and POWER which is what I assume he is doing here considering he provides operating systems for multiple architectures. We're talking about an architecture that started with the 8086 and despite changes t…

I implement high-performance software systems in C++ as my day job. The software has to compile and run on Linux, Solaris, and AIX. The same code is 2x slower on AIX (Power) and 3x-5x slower on Solaris (Sparc) than on Linux (x86). So say whatever you want about theoretical differences in architectures, but in the real world Sparc and Power systems are absolutely not competitive, both on price (absolute $$, and per CPU) and performance (per CPU - they do have more cpu cores, usually).

Re: XSA-108 Advisory

#32

Post by jedicoffee » Wed, Oct 01, 2014, 1:56 PM UTC

akerl_ wrote: post #24

asb wrote: post #20

Can somebody please confirm that it is impossible to boot a HVM system on Linode? The hypervisor on my Linode host certainly supports HVM (according to cat /sys/hypervisor/properties/capabilities). The host Xen is 4.1 and therefore vulnerable in the case that another user could be running HV guests.

There is no such thing as an HVM Linode server, all Linodes are PV.

Akerl speaks the truth. We're good to go.

Re: XSA-108 Advisory

#33

Post by Someone1234 » Wed, Oct 01, 2014, 2:09 PM UTC

trekkin wrote: post #31

sudowhodoido wrote: post #25

Earlier quoted context omitted.

Not really. He's right. The memory, paging and protection model for X86 is fugly at best. It's very easy to hang yourself as demonstrated. You can be as insulting as you like if you compare X86 (and X86-64) to SPARC and POWER which is what I assume he is doing here considering he provides operating systems for multiple architectures. We're talking about an architecture that started with the 8086 and despite changes t…

I implement high-performance software systems in C++ as my day job. The software has to compile and run on Linux, Solaris, and AIX. The same code is 2x slower on AIX (Power) and 3x-5x slower on Solaris (Sparc) than on Linux (x86). So say whatever you want about theoretical differences in architectures, but in the real world Sparc and Power systems are absolutely not competitive, both on price (absolute $$, and per CP…

That's just a circular way of saying "x86 is more popular, therefore better." Which doesn't address the person aboves' point that x86 is inferior in terms of its design.

Of course x86 is going to be faster per dollar spent. One is mass market (x86-64) and the other two are hugely niche (Sparc and Power). Plus the Linux kernel has by far the most human-hours spent on its development relative to every other operating system in the world.

There's also a reason why some of x86's market share has been eaten up by ARM. Moving from x86 to ARM was hugely expensive by all measures, but it was worthwhile because x86 was so wasteful.

Re: XSA-108 Advisory

#34

Post by cthalupa » Wed, Oct 01, 2014, 2:12 PM UTC

danielweber wrote: post #19

ukandy wrote: post #8

Earlier quoted context omitted.

Pre-disclosure list is at the bottom of this page.. http://www.xenproject.org/security-policy.html

Huh, I have a tiny machine at one of those smaller places, and they are on the list. Good to know the smaller players can build up a reputation for embargoing, too.

They spell out the requirements for getting on the list - one of the valid ways to qualify is basically just being a webhost that uses Xen.

Re: XSA-108 Advisory

#35

Post by sudowhodoido » Wed, Oct 01, 2014, 2:21 PM UTC

trekkin wrote: post #31

sudowhodoido wrote: post #25

Earlier quoted context omitted.

Not really. He's right. The memory, paging and protection model for X86 is fugly at best. It's very easy to hang yourself as demonstrated. You can be as insulting as you like if you compare X86 (and X86-64) to SPARC and POWER which is what I assume he is doing here considering he provides operating systems for multiple architectures. We're talking about an architecture that started with the 8086 and despite changes t…

I implement high-performance software systems in C++ as my day job. The software has to compile and run on Linux, Solaris, and AIX. The same code is 2x slower on AIX (Power) and 3x-5x slower on Solaris (Sparc) than on Linux (x86). So say whatever you want about theoretical differences in architectures, but in the real world Sparc and Power systems are absolutely not competitive, both on price (absolute $$, and per CP…

I agree entirely with you. However that doesn't invalidate my point.

Re: XSA-108 Advisory

#36

Post by cesarb » Wed, Oct 01, 2014, 2:24 PM UTC

sudowhodoido wrote: post #28

tptacek wrote: post #26

Earlier quoted context omitted.

Didn't deRaadt have to commit OpenBSD workarounds to TLB errata just a couple years back? I don't think he's making things up.

Yes. See: http://marc.info/?l=openbsd-misc&m=118296441702631

This reminds me of the Intel SYSRET bug: https://blog.xenproject.org/2012/06/13/the-intel-sysret-priv...

In which AMD defines a new instruction, and Intel copies it with a subtle difference which trips up everyone (AMD's way is better IMO, and it came first).

Re: XSA-108 Advisory

#37

Post by cperciva » Wed, Oct 01, 2014, 2:29 PM UTC

sudowhodoido wrote: post #10

Well looks like Mr De Raadt was right again: 'x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't writ…

> I have hope for things like cgroups/jails and MAC/SELinux over virtualization.

The attack surface of a virtualization layer is much smaller than the attack surface of an operating system kernel.

Re: XSA-108 Advisory

#38

Post by diydsp » Wed, Oct 01, 2014, 2:33 PM UTC

mzs wrote: post #12

alexduros wrote: post #7

interesting link ... from 2010 http://xen.1045712.n5.nabble.com/x2APIC-emulation-for-HVM-gu...

good find: @@ -2189,6 +2190,11 @@ *msr_content = vcpu_vlapic(v)->hw.apic_base_msr; break; + case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0x3ff: + if ( hvm_x2apic_msr_read(v, msr, msr_content) ) + goto gp_fault; + break; + case MSR_IA32_CR_PAT: *msr_content = v->arch.hvm_vcpu.pat_cr; break; @@ -2296,6 +2302,11 @@ vlapic_msr_set(vcpu_vlapic(v), msr_content); break; + case MSR_IA32_APICBASE_MSR ... MSR_IA32_AP…

What is the "..." operator? I have never seen that before. I can't find any references to it. Is that a macro specific to this project? [I checked the post above, but it doesn't match this source code exactly (and doesn't have ... as an operator).]

Re: XSA-108 Advisory

#39

Post by _delirium » Wed, Oct 01, 2014, 2:39 PM UTC

diydsp wrote: post #38

mzs wrote: post #12

Earlier quoted context omitted.

good find: @@ -2189,6 +2190,11 @@ *msr_content = vcpu_vlapic(v)->hw.apic_base_msr; break; + case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0x3ff: + if ( hvm_x2apic_msr_read(v, msr, msr_content) ) + goto gp_fault; + break; + case MSR_IA32_CR_PAT: *msr_content = v->arch.hvm_vcpu.pat_cr; break; @@ -2296,6 +2302,11 @@ vlapic_msr_set(vcpu_vlapic(v), msr_content); break; + case MSR_IA32_APICBASE_MSR ... MSR_IA32_AP…

What is the "..." operator? I have never seen that before. I can't find any references to it. Is that a macro specific to this project? [I checked the post above, but it doesn't match this source code exactly (and doesn't have ... as an operator).]

It's a GNU extension that lets you define ranges in switch statements' cases: https://gcc.gnu.org/onlinedocs/gcc/Case-Ranges.html

Re: XSA-108 Advisory

#40

Post by joosters » Wed, Oct 01, 2014, 2:56 PM UTC

sudowhodoido wrote: post #25

joosters wrote: post #14

Earlier quoted context omitted.

This is just FUD and in the usual insulting De Raadt style of communicating. 'barely has correct page protection' is just a way of saying 'has correct page protection, but I want to be really snotty about it'. So, highlighting a non-problem. No-one is claiming that virtualization makes a system magically completely secure, but do people actually believe that it makes it less secure? (Compared to, running the same sof…

Not really. He's right. The memory, paging and protection model for X86 is fugly at best. It's very easy to hang yourself as demonstrated. You can be as insulting as you like if you compare X86 (and X86-64) to SPARC and POWER which is what I assume he is doing here considering he provides operating systems for multiple architectures. We're talking about an architecture that started with the 8086 and despite changes t…

It might well be fugly but it works. That's the key point.

I'm sure Intel (or anyone else), if they could develop x86 again from scratch, and with the benefit of hindsight, would create a much nicer mechanism. But that's just speculation and wishful thinking.