ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
cyberus-technology.de
ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
1–10 of 337 posts
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#2According to their blog post[1], there is little you can do against this. Running different applications on different cpus help against them reading each other’s data but an rogue process can still read data from the “super ordinated kernel” or hypervisor.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#3Pandora's box was opened with the public disclosure of Spectre and Meltdown. Security researchers will continue to find new and better ways of attacking the security boundaries in processors, and there's unlikely to be an end to this any time soon. Exciting time to be in security, not such an exciting time to be a potential victim.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#4I really hate these descriptions of SMT as some kind of violation of the natural relationship between CPU frontend and backend. The idea that there is a “physical core” and a “logical core” does not map to reality.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#59% hit potentially on performance in data center. Add in all the Spectre and meltdown mitigations and we have potentially lost nearly two generations of Intel performance increases.
Just shows the hoops and tricks needed to keep making, on paper, faster processors year on year but without node shrinks to give headroom.
14nm++++ is played out.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#6Looks like AMD Cpus are safe again.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#7I really hate these descriptions of SMT as some kind of violation of the natural relationship between CPU frontend and backend. The idea that there is a “physical core” and a “logical core” does not map to reality.
The idea that there is a “physical core” and a “logical core” does not map to reality.
This is the terminology that Intel itself uses in its documentation to describe its products, though. To be fair, they say "physical processor" and "logical processor", not "core".
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#8Pandora's box was opened with the public disclosure of Spectre and Meltdown. Security researchers will continue to find new and better ways of attacking the security boundaries in processors, and there's unlikely to be an end to this any time soon. Exciting time to be in security, not such an exciting time to be a potential victim.
Not arguing just asking, but how has Pandora's box been opened with the discloser of Spectre and Meltdown? We've had security researchers discovering and reporting vulnerabilities since there were computers as far as I know?
I do agree that this won't end soon though. It appears to me that many of the methods CPU's use for better performance are fundamentally flawed in their security, and it's not like we can expect the millions of affected machines to be upgraded to mitigate this.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#9In short:
* Core and Xeon CPUs affected, others apparently not.
* HT on or off, any kind of virtualization, and even SGX are penetrable.
* Not OS-specific, apparently.
* Sample code provided.
https://www.cyberus-technology.de/posts/2019-05-14-zombieloa...
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#10Sorry for being naive. Are these kind of CPU Securities vulnerabilities new? Why it is in the past 20 years we have had close to zero in the news ( At least I wasn't aware of any ) and ever since Spectre and Meltdown we have something new like every few months.
And as far as I am aware they are mostly Intel CPU only. Why? And Why not AMD? Something in the Intel design process went wrong? And yet all the Cloud Vendor are still buying Intel and giving very little business to AMD.