[deleted]
ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
201–210 of 337 posts
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#202Earlier quoted context omitted.
> In the x86 space , Meltdown absolutely was down to one company Serious weasel wording, outside of x86 space every other high end architecture also had Meltdown issues, ARM, and IBM's POWER and mainframe designs.
Erm, no? Meltdown was intel only. Spectre affects absolutely every architecture with speculative execution, but Meltdown (which allows crossing process and security boundaries) are absolutely unique to Intel.
Erm, check out Wikipedia https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili... and follow the links? Meltdown is CVE-2017-5754, see: https://developer.arm.com/support/arm-security-updates/specu... where as I recall ARM initially described the Cortex-A75 as having a "variant", but now just lumps it in with the CVE. And the IBM info is also there, POWER7+ through POWER9, and per Red Hat, mainframe/System Z.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#203[deleted]
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#204[deleted]
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#205Earlier quoted context omitted.
> In the x86 space , Meltdown absolutely was down to one company Serious weasel wording, outside of x86 space every other high end architecture also had Meltdown issues, ARM, and IBM's POWER and mainframe designs.
Everyone who does speculative execution had Spectre issues, but Meltdown-style vulnerabilities have been mostly Intel-exclusive. These new ones are too.
Maybe because Intel has shipped a thousand more SKUs and millions more CPUs with Meltdown than ARM, for which the Cortex-A75 was a new design, and IBM, which doesn't ship huge numbers of either POWER or mainframe CPUs??
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#206I'm sure I remember a post on here (or possibly /r/programming) a couple of years ago from an Intel employee mentioning that Intel was cutting a lot of QA staff, and that we should expect more bugs in the future. I could be imagining things though.
I remember a leak about a call to become "more agile" like some ARM designers, implying less time spent on verification.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#207[deleted]
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#208Earlier quoted context omitted.
The stream of critical CPU vulnerabilities starting with Spectre/Meltdown last year are related to speculative execution , not just Intel. (AMD and ARM CPUs are also vulnerable to Spectre, for example.) Intel CPUs are sometimes vulnerable to additional attacks because they speculate in more scenarios than other designs. But fundamentally, as long as multiple different trust domains are sharing one CPU that speculates…
> The safest bet now for the best security is probably to stick to in-order CPUs out-of-order execution != speculative execution. It is possible to have OoO without speculative execution. On the other hand they do tend to come as a pair since they both utilise multiple execution units, for instance the Intel Pentium in 1993 was the first x86 to have OoO or branch prediction (486 and those before were scalar CPUs).
OoO without speculation is completely pointless: the tipical reorder window is orders of magnitude larger than the average number of instructions between conditional jumps. I don't think there have ever been an OoO CPU without speculation.
OTOH speculation without OoO Is not only possible but in fact very common. For example the majority of non ancient in-order CPUs.
In fact the original pentium, contrary to your statement, was an in-order design (the pentium pro was the first Intel OoO design). Also I believe that 486 already had branch prediction. Pentium claim to fame was being superscalar (i.e it could execute, in some cases two instructions per cycle), a better FPU and better pipelined ALU (I think it had a fully pipelined multiply for example).
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#209Earlier quoted context omitted.
But they are, ARM to both a Meltdown variant and Spectre, as well IBM's POWER and mainframe chips, and AMD to Spectre.
They are not for all kind of attacks. E.g. this new one can only be reproduced on Intel, not on AMD and ARM. If you want to ban speculative execution for everything, you need to make the case that it's a fundamental issue and not an implementation specific issue. Right now, that's not the case for many of these vulnerabilities.
As I understand it, the Intel only vulnerabilities, Foreshadow/L1TF, and this set which I've not looked at the details of yet, are targeting specific Intel features, and there's no reason to believe a similar focus on the other companies' products wouldn't also find unique problems.
For example, the first version of Foreshadow went after the SGX enclave. Given how widespread Meltdown and Spectre bugs are, there's absolutely no reason to believe that the other vendors don't have similar unique problems.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#210In short: * Core and Xeon CPUs affected, others apparently not. * HT on or off, any kind of virtualization, and even SGX are penetrable. * Not OS-specific, apparently. * Sample code provided. https://www.cyberus-technology.de/posts/2019-05-14-zombieloa...
And here's the mitigation in NetBSD: https://github.com/NetBSD/src/commit/afab82aeafd0c51afc036a8...
Essentially: Intel released a microcode update which makes the `verw` instruction now magically flush MDS-affected buffers. On vulerable CPUs, this instruction now needs to be run on kernel exit; the microcode update won’t do it automatically on `sysexit`, unfortunately.