Will patches for this eventually trickle down to things like LineageOS?
LineageOS is based on official Android sources. The moment the official Android kernel is patched, LineageOS will use the patch.
Reading privileged memory with a side-channel
161–170 of 639 posts
Re: Reading privileged memory with a side-channel
#162Earlier quoted context omitted.
It probably means if you want mitigations right now, you can flip that flag. Otherwise wait for Chrome to auto-update with new versions that have mitigations enabled by default.
Would I be correct in assuming a browser-level mitigation isn't necessary if you're running a patched OS?
Wasn't there a PoC for a second issue of js reading memory from its own process? Could potentially be an issue (eg reading data from another website)
Re: Reading privileged memory with a side-channel
#163So how much legal liability are they exposed to due to this security flaw? Since this affects legacy systems that may not be able to be upgraded it seems like this issue will be around for a very long time.
Since this affects legacy systems that may not be able to be upgraded it seems like this issue will be around for a very long time.
It also only affects "legacy systems" which routinely run nontrusted code. If it's something like e.g. a server in a bank, chances are everything running on it has already been accounted for. This isn't like e.g. Heartbleed where you could just connect to any open server and read its memory --- you have to somehow get your code to run on it first.
Re: Reading privileged memory with a side-channel
#164It seems that Richard Stallman is not so paranoid after all:
> I am careful in how I use the Internet.
> I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it (using konqueror, which won't fetch from other sites in such a situation).
Re: Reading privileged memory with a side-channel
#165Earlier quoted context omitted.
Project Zero is very well known for things exactly like this. Partially, it's because they are incredibly talented, but there are also talented people in academia and in other security consultancies. The biggest difference with Project Zero is that their primary [0] goal is altruistic: find vulnerabilities, and let people who can fix them know (vs publishing papers, securing paying clients, auctioning zero-days, etc)…
Worth noting that in this case, many of the authors are in academia. It wasn't solely a Google project.
I read it as it was an independent discovery by project zero and by academia researchers.
Re: Reading privileged memory with a side-channel
#166Earlier quoted context omitted.
It says at the bottom they were both done by the same person.
That's funny, but also makes me wonder how you get contracted to do logos for things like this. Based strictly on her LinkedIn, she doesn't work for Google. Maybe a friend of someone? Kind of a cool gig though.
https://www.linkedin.com/feed/update/urn:li:activity:6354450...
says:
> Want to know what's really going on with the Intel security flaw everyone is talking about? Checkout https://meltdownattack.com to get all the details. This is my boyfriend's and his research team's latest work. An huge security breach which affects nearly all your computers! Stealing all your secrets never was that easy!
Re: Reading privileged memory with a side-channel
#167Earlier quoted context omitted.
That's unclear, to the point of being factually wrong. Variant 2 and Variant 3 POCs only affect Intel, and those are the ones people are most talking about, and at least to me, the most concerning. Treating them as a group, ignores the very real differences in effect. https://googleprojectzero.blogspot.com/2018/01/reading-privi...
https://meltdownattack.com/meltdown.pdf >6.4 Limitations on ARM and AMD We also tried to reproduce the Meltdown bug on several ARM and AMD CPUs. However, we did not manage to successfully leak kernel memory with the attack described in Section 5, neither on ARM nor on AMD. The reasons for this can be manifold. First of all, our implementation might simply be too slow and a more optimized version might succeed. For in…
the intel behaviour is probably the result of an optimization / architectural decision. like when the micro ops fetch a value from memory they are probably fetching the real value then setting a flag that the instruction is invalid. like it might be cheaper to deal with the problem later in the pipeline than earlier.
but it might also be reasonable in a different architecture to fetch 0 straight away to the micro op when the memory access is invalid and set a flag to raise the exception as well. in this situation you don't have the problem because you are just shuffling around invalid data.
Re: Reading privileged memory with a side-channel
#168Earlier quoted context omitted.
It probably means if you want mitigations right now, you can flip that flag. Otherwise wait for Chrome to auto-update with new versions that have mitigations enabled by default.
Would I be correct in assuming a browser-level mitigation isn't necessary if you're running a patched OS?
no
Re: Reading privileged memory with a side-channel
#169Re: Reading privileged memory with a side-channel
#170Papers describing each attack: https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf From the spectre paper: >As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). Scary stuff.
Getting flashbacks of brainsmoke's JS PoC: https://youtu.be/ewe3-mUku94?t=1766 Edit: Also, PoCs for unpatched Windows by pwnallthethings: https://github.com/turbo/KPTI-PoC-Collection
rightfully so: