Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

cyberus-technology.de

Post reply on HN
Print view View original

161–170 of 337 posts

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#161

Post by mr_toad »

IgorPartola wrote: post #84

So at what point do we start producing CPUs specifically aimed at running a kernel/userland? Why don't we have a CPU architecture where a master core is dedicated to running the kernel and a bunch of other cores run userland programs? I am genuinely curious. I understand that x86 is now the dominant platform in cloud computing. But it's not like virtualization needs to be infinitely nested, right? Why not have the ho…

> Why don't we have a CPU architecture where a master core is dedicated to running the kernel and a bunch of other cores run userland programs?

Sounds a lot like IMB’s Cell architecture.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#162

Post by mwcmitchell »

fakwandi_priv wrote: post #114

Apparently Intel attempted to play down the issue by trying to award the researchers with the 40,000 dollar tier reward and a separate 80,000 dollar reward as a "gift" (which the researchers kindly denied) instead of the maximum 100,000 reward for finding a critical vulnerability. Intel was also planning to wait for at least another 6 months before bringing this to light if it wasn't for the researchers threatening t…

That speaks volumes to the integrity of the researchers. Similarly, it speaks to a lack of the same @ Intel. Bribing for silence is not the way to deal with vulnerabilities. I’m glad the researchers are getting some recognition.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#163

Post by robotresearcher »

kevin_thibedeau wrote: post #59
robotresearcher wrote: post #49

Earlier quoted context omitted.

Since there is relatively little AMD running, you would expect relatively little investment in attacking it.

> We were unable to reproduce this behavior on non-Intel CPUs and consider it likely that this is an implementation issue affecting only Intel CPUs. The attacks are being attempted. AMD just didn't screw up as badly.

Trying Intel attacks on AMD just in case is cheap and easy, and in this case fruitless. It doesn’t shed any light on how much effort is being put into finding AMD’s own specific screw ups.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#164

Post by dfrage »

spamizbad wrote: post #147
Fej wrote: post #76

What is the recommended course of action? Stop buying Intel products, and devices which contain them? What about devices with older processors? I'm still running a Sandy Bridge rig and it works fine, except for the side channel vulnerablities. It's probably not going to be patched. I also have a cheaper computer with a Skylake processor, which is newer yet still vulnerable! It's only a matter of time until something…

Step one: switch to in-order cores. Step two: cheekily author a Medium article titled Tomasulo's Algorithm Considered Harmful

Maybe be more alliterative and title it Tomasulo's Algorithm Considered Tempting? Because as far as I have found without reading original documents, its development and use in the IBM System 360/Models 91 and 95 was only but fully out-of-order on the floating point engine, they didn't have the gates, implemented with discrete transistors, to go further to speculative, or include any scalar hardware.

Hitting diminishing returns on caches with an ever increasing gate budget is I believe prompted this second generation starting in the 1990s which adds speculative execution, which the algorithm with all those extra hidden registers really invites you to do.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#165

Post by 1Y3 »

mettamage wrote: post #152

I just want to plug their course hardware security (at the VU University Amsterdam). It's an amazing course and it costs 1200 euro's for students who need to pay full price. I've learned a lot about Spectre, Meltdown and novel forms of cache attacks and Rowhammer when I took it.

Offtopic: Are you familiar with the AI departments/ courses (master) at VU? I have the opportunity to go but haven't decided yet. (Interested in human-centred and modern ML with neural networks)

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#166

Post by cesarb »

saltcured wrote: post #151
faissaloo wrote: post #18

Earlier quoted context omitted.

I wonder at what point the hardware fix for these issues stop becoming worthwhile and if we'll see a resurgence of processors without speculative execution or any of these other speed ups.

Ironically, a high performance, general purpose architecture without speculative execution might require a deep reinvestment in SMT. Instead of trying to speculatively make one thread fast to mask IO stalls, run a large pool of threads that can stall frequently but still keep the execution units and memory channels busy. To avoid reintroducing these spectre like bugs, you'd have to conservatively design the per-threa…

> Instead of trying to speculatively make one thread fast to mask IO stalls, run a large pool of threads that can stall frequently but still keep the execution units and memory channels busy.

Isn't something like that done for GPUs? They have the advantage of having a massive number of threads to execute. For CPUs, the number of runnable threads tends to be lower.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#167

Post by floatboth »

dfrage wrote: post #129
dpwm wrote: post #101

Earlier quoted context omitted.

> Spectre/Meltdown, which leak the speculative information via the cache side-channel, completely blindsided the architecture community; it wasn't just one incompetent company. In the x86 space, Meltdown absolutely was down to one company apparently deciding to over-optimize for performance. I can't find it now, but I remember reading a thread from (I think) the OpenBSD devs about how the Intel MMU documentation desc…

> In the x86 space , Meltdown absolutely was down to one company Serious weasel wording, outside of x86 space every other high end architecture also had Meltdown issues, ARM, and IBM's POWER and mainframe designs.

Everyone who does speculative execution had Spectre issues, but Meltdown-style vulnerabilities have been mostly Intel-exclusive. These new ones are too.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#168

Post by roblabla »

dfrage wrote: post #129
dpwm wrote: post #101

Earlier quoted context omitted.

> Spectre/Meltdown, which leak the speculative information via the cache side-channel, completely blindsided the architecture community; it wasn't just one incompetent company. In the x86 space, Meltdown absolutely was down to one company apparently deciding to over-optimize for performance. I can't find it now, but I remember reading a thread from (I think) the OpenBSD devs about how the Intel MMU documentation desc…

> In the x86 space , Meltdown absolutely was down to one company Serious weasel wording, outside of x86 space every other high end architecture also had Meltdown issues, ARM, and IBM's POWER and mainframe designs.

Erm, no? Meltdown was intel only. Spectre affects absolutely every architecture with speculative execution, but Meltdown (which allows crossing process and security boundaries) are absolutely unique to Intel.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#169

Post by XorNot »

dexen wrote: post #50
farisjarrah wrote: post #45

Earlier quoted context omitted.

I feel like people with these sorts of hardline views on security, might just be so concerned with safety that their argument misses the whole opportunity cost of not being 100% safe in our usage of technology. If we needed to make sure everything was safe and perfectly secure, the world would have missed out on a lot of innovative software. Tough thing to contend with is that the security people are hardly ever wron…

>hardline views on security The only hardline view on security you'll encounter in the wild is "security is practical in our computational environments"[1]. Only half-joking here. My reading of Theo's quote is merely "the combination of x86/IA32/AMD64 and virtualization gives little to no factual security benefits, and plenty of pitfals". I don't see Theo as being a hardliner about security, just meticulous about goo…

Except that's objectively wrong - x86 virtualization breakouts have been extremely rare in practice, and fixable till recently.

The new class of attacks we now see target any type of shared code execution environment. OpenBSD is as vulnerable to this as anything else.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#170

Post by p1necone »

I'm sure I remember a post on here (or possibly /r/programming) a couple of years ago from an Intel employee mentioning that Intel was cutting a lot of QA staff, and that we should expect more bugs in the future. I could be imagining things though.
Post reply on HN