Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meltdown Proof-of-Concept

github.com

Post reply on HN
Print view View original

141–150 of 187 posts

Re: Meltdown Proof-of-Concept

#141

Post by tptacek »

_wmd wrote: post #139
tptacek wrote: post #128

Earlier quoted context omitted.

Can I put a plug in again for how fucking cool the Meltdown and Spectre attacks are? They're much more interesting than just cache timing, which as you note have been well-known for at least a decade (and much earlier in the covert channel literature). Unlike "vanilla" cache-timing attacks: * Meltdown and Spectre involve transient instructions, instructions that from the perspective of the ISA never actually run . *…

There's no reason to invent new terminology for speculative execution. Also, the mapping between the variety of CPU caches and real memory has been known imperfect since the beginning of time. But meanwhile, yes, can definitely agree how fucking cool it all is

What new terminology got invented?

Re: Meltdown Proof-of-Concept

#142

Post by Valmar »

trendia wrote: post #27

Linux 4.15 and the appropriate modules protect against the attack. To test, set CONFIG_PAGE_TABLE_ISOLATION=y. That is: sudo apt-get build-dep linux sudo apt-get install gcc-6-plugin-dev libelf-dev libncurses5-dev cd /usr/src wget https://git.kernel.org/torvalds/t/linux-4.15-rc7.tar.gz tar -xvf linux-4.15-rc7.tar.gz cd linux-4.15-rc7 cp /boot/config-`uname -r` .config make CONFIG_PAGE_TABLE_ISOLATION=y deb-pkg

Page Table Isolation has been backported to 4.14.12, so no need to test with the rc.

Re: Meltdown Proof-of-Concept

#143

Post by jandrese »

londons_explore wrote: post #112
gpderetta wrote: post #101

Earlier quoted context omitted.

Main memory access take an order of hundred cycles. D1 cache hit access usually take usually 3-4 cycles. Microarchitecture designers will take heroic efforts to even shave a single cycle here. Adding an overhead of even a couple of cycles would be a huge deal. Having said that, AMD CPUs are the existence proof that you can be immune to meltdown with no significant overhead. Spectre is a completely different issue tho…

AMD CPUs have pretty poor single threaded performance. Perhaps that because they haven't taken the speed short-cuts that Intel took...?

Didn't Ryzen close the single thread performance gap quite a bit?

But yeah, protecting against it means implementing memory protection in more places in the CPU. More gates and the possibility of becoming a bottleneck.

Re: Meltdown Proof-of-Concept

#144

Post by rdtsc »

arkadiyt wrote: post #104
martin1975 wrote: post #64

I'm curious if someone can point me to any source that discusses how the next generation of CPUs that Intel, AMD, ARM might be working on is actually going to address this & the Spectre issue architecturally.. It's great that we have a potentially performance killing fix but the real "fix" or rather, solution, is to alter the architecture. Since I'm not an EE/CE dude... is anyone aware of where such discussions on th…

> Makes you wonder if the NSA knew about it all along :) Former head of TAO Rob Joyce said "NSA did not know about the flaw, has not exploited it and certainly the U.S. government would never put a major company like Intel in a position of risk like this to try to hold open a vulnerability." [1] Who knows if that's true or not, though. Certainly the U.S. government has done exactly that many times in the past (like w…

That is an odd one. Why say that instead of of the usual, "we can't comment on that".

> U.S. government would never put a major company like Intel in a position of risk like this to try to hold open a vulnerability." [1]

They subverted the Dual_EC_DRBG standardization process. Had they not been caught and the algorithm ended up on more devices they would be hurting not just major companies but whole industries.

Also for reference: https://en.wikipedia.org/wiki/Bullrun_(decryption_program)

Re: Meltdown Proof-of-Concept

#145

Post by _wmd »

tptacek wrote: post #141
_wmd wrote: post #139

Earlier quoted context omitted.

There's no reason to invent new terminology for speculative execution. Also, the mapping between the variety of CPU caches and real memory has been known imperfect since the beginning of time. But meanwhile, yes, can definitely agree how fucking cool it all is

What new terminology got invented?

Perhaps I've been living under a rock for the past 30 years, but transient instructions are a new idea for me

Re: Meltdown Proof-of-Concept

#146

Post by tptacek »

_wmd wrote: post #145
tptacek wrote: post #141

Earlier quoted context omitted.

What new terminology got invented?

Perhaps I've been living under a rock for the past 30 years, but transient instructions are a new idea for me

What's the "old" term for speculated instructions that aren't retired?

Re: Meltdown Proof-of-Concept

#147

Post by chx »

krylon wrote: post #79
martin1975 wrote: post #64

I'm curious if someone can point me to any source that discusses how the next generation of CPUs that Intel, AMD, ARM might be working on is actually going to address this & the Spectre issue architecturally.. It's great that we have a potentially performance killing fix but the real "fix" or rather, solution, is to alter the architecture. Since I'm not an EE/CE dude... is anyone aware of where such discussions on th…

> by the way, that PoC was intense. Makes you wonder if the NSA knew about it all along :) Colin Percival found a very similar issue with Intel's implementation of SMT on the Pentium 4 in 2005: http://www.daemonology.net/papers/htt.pdf So the general idea of using timing attacks against the cache to leak memory has been known for at least that long. In 2016, two researchers from the University of Graz gave a talk at…

> In light of that, I would be surprised if the NSA had not known about this.

Call me a tinfoil hat conspiracist but the only rational explanation I can find of IBM POWER and z CPUs still vulnerable to Spectre is the NSA forcing IBM not to fix it. I read somewhere that the z196 had three magnitudes more validation routines than the Intel Core at that time. It's extremely hard to believe they haven't caught this.

Re: Meltdown Proof-of-Concept

#148

Post by arrestedDevelpr »

SheinhardtWigCo wrote: post #113
arkadiyt wrote: post #104

Earlier quoted context omitted.

> Makes you wonder if the NSA knew about it all along :) Former head of TAO Rob Joyce said "NSA did not know about the flaw, has not exploited it and certainly the U.S. government would never put a major company like Intel in a position of risk like this to try to hold open a vulnerability." [1] Who knows if that's true or not, though. Certainly the U.S. government has done exactly that many times in the past (like w…

It's odd to publicly state that they didn't know about it, because now if they don't do the same after the next big flaw comes out, the implication will be that they indeed knew and were quietly exploiting it. I thought that was why they generally don't comment on these things. The less-charitable assumption is that they'll make this claim every time regardless of whether it's true. The claim that "the U.S. governmen…

Implications? Who cares what the peanut gallery thinks?

Re: Meltdown Proof-of-Concept

#149

Post by dx034 »

runesoerensen wrote: post #3

The Project Zero bug report (with PoCs/timeline) was also made public a few minutes ago https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

So this specifically states AMD as well. Can someone explain in how far AMD is now affected? I thought they're not affected by the most severe bug?

Re: Meltdown Proof-of-Concept

#150

Post by loeg »

dx034 wrote: post #149
runesoerensen wrote: post #3

The Project Zero bug report (with PoCs/timeline) was also made public a few minutes ago https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

So this specifically states AMD as well. Can someone explain in how far AMD is now affected? I thought they're not affected by the most severe bug?

AMD is affected by Spectre (variants 1 and 2) but not Meltdown (variant 3). This is consistent with the project zero bug.
Post reply on HN