Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reading privileged memory with a side-channel

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

191–200 of 639 posts

Re: Reading privileged memory with a side-channel

#191

Post by ajasmin »

tonfa wrote: post #165
cjbprime wrote: post #137

Earlier quoted context omitted.

Worth noting that in this case, many of the authors are in academia. It wasn't solely a Google project.

I read it as it was an independent discovery by project zero and by academia researchers.

Independent discovery don't happen overnight. Intel must have been aware of these vulnerabilities for some time.

edit: I'm sure everyone involved acted responsibly. I'm just curious as how far apart these independent discoveries were made.

The bug has been around forever, but it must have been discovered relatively recently since it's not fixed in hardware yet.

I've always been baffled by the concept of simultaneous discovery.

Re: Reading privileged memory with a side-channel

#192

Post by lettergram »

digikata wrote: post #42
lettergram wrote: post #32

Earlier quoted context omitted.

Here's a list of what google tested: Intel(R) Xeon(R) CPU E5-1650 v3 @ 3.50GHz (called "Intel Haswell Xeon CPU" in the rest of this document) AMD FX(tm)-8320 Eight-Core Processor (called "AMD FX CPU" in the rest of this document) AMD PRO A8-9600 R7, 10 COMPUTE CORES 4C+6G (called "AMD PRO CPU" in the rest of this document) An ARM Cortex A57 core of a Google Nexus 5x phone [6] (called "ARM Cortex A57" in the rest of t…

So there's a bit of an unknown if AMD's most recent generation of processor has the Spectre vulnerability?

We know that the scariest attack "meltdown", cannot be reproduced on AMD or ARM chips at all[1]. The second attack "Spectre" is also greatly mitigated due the neural network predicting pathways for the application. Thus it's unlikely/less-likely that you'll be able to access other locations in memory[2]. However, it's definitely possible.

[1] https://meltdownattack.com/meltdown.pdf

[2] https://spectreattack.com/spectre.pdf

Re: Reading privileged memory with a side-channel

#193

Post by bpye »

mintplant wrote: post #155
013a wrote: post #148

Earlier quoted context omitted.

It probably means if you want mitigations right now, you can flip that flag. Otherwise wait for Chrome to auto-update with new versions that have mitigations enabled by default.

Would I be correct in assuming a browser-level mitigation isn't necessary if you're running a patched OS?

The OS patch stops you reading kernel space from user space trivially (ie. without eBPF in the Project Zero example). You can still cause leakage from the same context, for example, the V8 JIT can read all of the processes memory, without site isolation that can include data on other web pages, passwords, cookies, etc.

Re: Reading privileged memory with a side-channel

#194

Post by theptip »

jotux wrote: post #115

Papers describing each attack: https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf From the spectre paper: >As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). Scary stuff.

I think this means we should consider all browser processes to be completely insecure, until mitigations are applied (e.g. Chrome's Site Isolation: https://www.chromium.org/Home/chromium-security/ssca).

Looks like any session token/state could be exfiltrated from your Gmail tab to a malicious JS app running in-process, for example.

Am I overreacting here?

Re: Reading privileged memory with a side-channel

#195

Post by userbinator »

madez wrote: post #109
trevyn wrote: post #73

Earlier quoted context omitted.

"We wrote a JavaScript program that successfully reads data from the address space of the browser process running it." Yeah, it's pretty bad.

A perfect occasion to invite others into my current exercise of using the web without JavaScript.

...and for those of us who leave JS off by default except for a few very trusted sites, the bar for turning on JS on a site that asks to just went up a lot higher.

Re: Reading privileged memory with a side-channel

#196

Post by djur »

Krenair wrote: post #166
partiallypro wrote: post #129

Earlier quoted context omitted.

That's funny, but also makes me wonder how you get contracted to do logos for things like this. Based strictly on her LinkedIn, she doesn't work for Google. Maybe a friend of someone? Kind of a cool gig though.

https://www.linkedin.com/feed/update/urn:li:activity:6354450... says: > Want to know what's really going on with the Intel security flaw everyone is talking about? Checkout https://meltdownattack.com to get all the details. This is my boyfriend's and his research team's latest work. An huge security breach which affects nearly all your computers! Stealing all your secrets never was that easy!

I thought the presence of a branch in the logo was clever.

Re: Reading privileged memory with a side-channel

#197

Post by ece »

olliej wrote: post #169
ece wrote: post #139

Earlier quoted context omitted.

The register has more details. Worth a read.

the google site has the actual white papers detailing the attacks.

The register has the tweet with actual code for spectre, and more details from the manufacturers and potential fixes. Seriosuly? They're both worth a read.

Re: Reading privileged memory with a side-channel

#198

Post by j_coder »

Isn't possible for the kernel to patch all clflush instructions when the software is loaded to keep a circular list of all evicted addresses that would be evicted again on the interrupt that happens when the protected address is read? This way the the timing attack would not be possible.

Re: Reading privileged memory with a side-channel

#199

Post by aeleos »

Wow so intel comes and says what is all the panic about there is nothing wrong (despite knowing this) and then amazon drops the we are updating everything right now bomb and then google drops the mother of all cpu bugs. In a previous thread someone was asking if it really is all that bad and at this point I think it’s safe to say that yea, it is.

Re: Reading privileged memory with a side-channel

#200

Post by rurban »

bloorp wrote: post #95

So is speculative execution just inherently flawed like this, or can we expect chips in 2 years that let operating systems go back to the old TLB behavior?

Only on Intel. Others restrict prefetches on permissions.

I think this might even be fixed by microcode patches on Intel, at least os specific, looking at the first address bit.

Post reply on HN