Live data from Hacker News

Zenbleed

lock.cmpxchg8b.com

121–130 of 378 posts

Re: Zenbleed

#121
post #50

Earlier quoted context omitted.

Or adds a guard. They mention perf issues for the workaround but they're notably absent from the microcode commentary. I wonder what this is going to do to the new AMD hardware AWS is trying to roll out, which is supposed to be a substantial performance bump over the previous generation.

It looks like this is a Zen 2-only exploit, so it shouldn't have any impact - AWS are likely already running hardware that isn't vulnerable to this

The way Spectre and Meltdown played out, you'll have to excuse me if I stand outside the blast radius while we figure out if there's a chapter 2, 3 or 4 to this story.

They've proven Zen 2 has this problem. They haven't proven no other AMD processors have it. A bunch of people looking to make names for themselves are probably busily testing every other AMD processor for a similar exploit.

Re: Zenbleed

#122
post #103
post #100

Earlier quoted context omitted.

If you already have the package amd64-microcode installed (highly likely), then yes it will be updated automatically. https://packages.ubuntu.com/search?keywords=amd64-microcode

Great, thanks. Sort of weirds me out that my OS can just silently update my CPU - I didn’t realize I was giving it that level of control… I guess it’s good vs the alternative of no-one actually updating for exploits like his though.

It does not upgrade your cpu, it loads up the firemware when you boot Linux.

Re: Zenbleed

#124

This link seems hugged to death, so here's an alternate source: AMD 'Zenbleed' Bug Allows Data Theft From Zen 2 Processors, Patches Coming: https://www.tomshardware.com/news/zenbleed-bug-allows-data-t... >

This story has comments from AMD, too.

Re: Zenbleed

#125
post #64
post #62

Earlier quoted context omitted.

Explain that like I’m 5?

The patch for this exploit is to load AMD's updated microcode.

I'm not sure five year olds know what microcode is. I'm 35, been in tech nearly 20 years and don't recall having heard that specific term before today.

Re: Zenbleed

#126
post #38

Earlier quoted context omitted.

does it require physical access to the machine?

I was able to reproduce the vulnerability using javascript on a webpage. Therefore, no.

I'll take this as bullshit until there's a POC

Re: Zenbleed

#128
post #64

Earlier quoted context omitted.

The patch for this exploit is to load AMD's updated microcode.

I'm not sure five year olds know what microcode is. I'm 35, been in tech nearly 20 years and don't recall having heard that specific term before today.

But well educated five year olds from good schools would know it.

Re: Zenbleed

#129
post #52

Earlier quoted context omitted.

welp, that's unfortunate indeed. It's a single-core 128 MB VPS, which seemed fine for my boring static html articles. I guess I underestimated the interest.

FWIW, enabling gzip/zstd compression in your HTTP server could help.

A single core machine already overloaded is going to get even worse introducing the cpu overhead of gzipping response bodies (assuming it’s cpu bound and not IO bound)

Cache control headers will help with return traffic

More cpu cores

If using nginx ensure sendfile is enabled and workers are set to auto or tuned for your setup

Check ulimit file handle limits

Offload static assets to cdn

Since it’s a static html site, you could even host on s3, netlify, etc

Re: Zenbleed

#130

This is incredibly scary. On my Zen 2 box (Ryzen 3600) logging the output of the exploit running as an unprivileged user while copying and pasting a string into a text editor in the background (I used Kate), resulted in pieces of the string being logged into the output of zenbleed. And this is after a few seconds of runtime mind you, not even a full minute. Thankfully the exploit is highly dependent on a specific asm…

I tried on my zen 2 box, and the same things works even when the exploit is run in a KVM.
Post reply on HN