Reading privileged memory with a side-channel • Hacker News Board

Re: Reading privileged memory with a side-channel

#181

Post by [deleted] » Wed, Jan 03, 2018, 11:55 PM UTC

buryat wrote: post #36

mrmondo wrote: post #13

"AMD chips are affected by some but not all of the vulnerabilities. AMD said that there is a "near zero risk to AMD processors at this time." British chipmaker ARM told news site Axios prior to this report that some of its processors, including its Cortex-A chips, are affected." - http://www.zdnet.com/article/security-flaws-affect-every-int... * Edit: From https://meltdownattack.com/ Which systems are affected by Mel…

That article links a commit [1] that contradicts this statement > AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault. And Axios [2] that…

[deleted]

Re: Reading privileged memory with a side-channel

#182

Post by FLUX-YOU » Wed, Jan 03, 2018, 11:57 PM UTC

minxomat wrote: post #140

jotux wrote: post #115

Papers describing each attack: https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf From the spectre paper: >As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). Scary stuff.

Getting flashbacks of brainsmoke's JS PoC: https://youtu.be/ewe3-mUku94?t=1766 Edit: Also, PoCs for unpatched Windows by pwnallthethings: https://github.com/turbo/KPTI-PoC-Collection

I do also wonder if some speculative prediction / branching stuff can be controlled through undocumented CPU instructions: https://www.youtube.com/watch?v=KrksBdWcZgQ

Re: Reading privileged memory with a side-channel

#183

Post by Havoc » Wed, Jan 03, 2018, 11:58 PM UTC

So what exactly are they going to do about spectre? Seems pretty unstoppable from what I can see.

Can they disable speculative exec completely for sensitive boxes or is this too baked in?

Re: Reading privileged memory with a side-channel

#184

Post by sbx320 » Thu, Jan 04, 2018, 12:00 AM UTC

digikata wrote: post #42

lettergram wrote: post #32

Earlier quoted context omitted.

Here's a list of what google tested: Intel(R) Xeon(R) CPU E5-1650 v3 @ 3.50GHz (called "Intel Haswell Xeon CPU" in the rest of this document) AMD FX(tm)-8320 Eight-Core Processor (called "AMD FX CPU" in the rest of this document) AMD PRO A8-9600 R7, 10 COMPUTE CORES 4C+6G (called "AMD PRO CPU" in the rest of this document) An ARM Cortex A57 core of a Google Nexus 5x phone [6] (called "ARM Cortex A57" in the rest of t…

So there's a bit of an unknown if AMD's most recent generation of processor has the Spectre vulnerability?

From the Spectre paper:

> We have also verified the attack’s applicability to AMD Ryzen CPUs.

Re: Reading privileged memory with a side-channel

#185

Post by mtanski » Thu, Jan 04, 2018, 12:01 AM UTC

AndrewBissell wrote: post #111

bloorp wrote: post #95

So is speculative execution just inherently flawed like this, or can we expect chips in 2 years that let operating systems go back to the old TLB behavior?

Yeah I was wondering this myself. Even if there's some fiddly hardware fix to make speculative execution secure, how much of its performance gains will we have to give up to get there?

Speculative execution as a concept should not be flawed. My take is that the results of illegal speculation should never be leaked in a visable way.

Re: Reading privileged memory with a side-channel

#186

Post by [deleted] » Thu, Jan 04, 2018, 12:02 AM UTC

buryat wrote: post #36

mrmondo wrote: post #13

"AMD chips are affected by some but not all of the vulnerabilities. AMD said that there is a "near zero risk to AMD processors at this time." British chipmaker ARM told news site Axios prior to this report that some of its processors, including its Cortex-A chips, are affected." - http://www.zdnet.com/article/security-flaws-affect-every-int... * Edit: From https://meltdownattack.com/ Which systems are affected by Mel…

That article links a commit [1] that contradicts this statement > AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault. And Axios [2] that…

[deleted]

Re: Reading privileged memory with a side-channel

#187

Post by jhallenworld » Thu, Jan 04, 2018, 12:02 AM UTC

jotux wrote: post #115

Papers describing each attack: https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf From the spectre paper: >As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). Scary stuff.

"Meltdown" is an Intel bug.

"Spectre" is very bad news and affects all modern CPUs. Mitigation is to insert mfence instructions throughout jit generated sandboxed code making it very slow, ugh. Otherwise assume that the entire process with jit generated code is open to reading by that code.

Any system which keeps data from multiple customers (or whatever) in the same process is going to be highly vulnerable.

Re: Reading privileged memory with a side-channel

#188

Post by comex » Thu, Jan 04, 2018, 12:02 AM UTC

tankenmate wrote: post #177

comex wrote: post #50

Earlier quoted context omitted.

Not just user memory reads. AMD CPUs won’t speculate loads from userland code directly to kernel memory, ignoring privilege checks (“Meltdown”). But they are still subject to the “Spectre” attack, which can disclose kernel memory by taking advantage of certain code patterns (which normally would be harmless) in kernel code.

But that means the root user or someone with root effective privs or CAP_* to load programs into a kernel interpreter or kernel JIT. If you've given someone permission to do this from a user process you've probably opened up to more mundane issues. I suspect this is why AMD says the issue is near zero, if you've given away the keys to the kernel you're already in trouble. AMD's ASID blocks the issues for VM guests (a…

For variant 1, a kernel JIT is definitely helpful, which is why the Project Zero PoC used it, but it's not required.

For variant 2, Project Zero used the eBPF interpreter as a gadget, a fake branch destination, without having to actually create an eBPF program or use the normal userland-facing eBPF APIs at all. And they only chose it as the least "annoying" option (see quote below).

edit: I'm not sure how ASID support would mitigate either of those variants, though there may be something I'm not thinking of. (It would help with variant 3, but that's the variant AMD wasn't vulnerable to in the first place.)

quote:

> At this point, it would normally be necessary to locate gadgets in the host kernel code that can be used to actually leak data by reading from an attacker-controlled location, shifting and masking the result appropriately and then using the result of that as offset to an attacker-controlled address for a load. But piecing gadgets together and figuring out which ones work in a speculation context seems annoying. So instead, we decided to use the eBPF interpreter, which is built into the host kernel - while there is no legitimate way to invoke it from inside a VM, the presence of the code in the host kernel's text section is sufficient to make it usable for the attack, just like with ordinary ROP gadgets.

Re: Reading privileged memory with a side-channel

#189

Post by wslh » Thu, Jan 04, 2018, 12:02 AM UTC

rurban wrote: post #106

wslh wrote: post #64

Has Google the best security team in the world? It seems like Google security is in a complete different league. I cannot imagine how this impacts companies handling fiat money or cryptocurrencies in the cloud like Coinbase in AWS.

Did you forget the Technical University of Graz students who came up with rowhammer and KAISER in the first hand?

Not really, they are mentioned in the article. What is fascinating is the number of discoveries by the Google team. The Wikipedia page has a summary of the prominent ones: https://en.wikipedia.org/wiki/Project_Zero_(Google) these are not bugs in obscure pieces of software but on major services and operating systems.

Re: Reading privileged memory with a side-channel

#190

Post by OldSchoolJohnny » Thu, Jan 04, 2018, 12:04 AM UTC

tarruda wrote: post #164

It seems that Richard Stallman is not so paranoid after all: > I am careful in how I use the Internet. > I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git ) that fetches them, much like wget, and then mails them back to me…

RMS remains a rambling nutjob and none of this is really applicable to the issue at hand.