Live data from Hacker News

New speculative attacks on Apple CPUs

predictors.fail

211–220 of 365 posts

Re: New speculative attacks on Apple CPUs

#211

Earlier quoted context omitted.

In my experience SMT is still faster for most workloads even with the mitigations.

It's a common misunderstanding that the CPU suddenly has twice as large performance envelope when SMT is enabled. Only specialized software/scenarios will tangibly benefit from the parasitic gains of SMT-induced extra parallelization, e.g. video encoders like x264 or CPU-bound raytracers to name a few examples. These gains typically amount to about 15-20% at the very extreme end. In some cases you'll see a performanc…

Are you sure about your statement

> video encoders like x264 or CPU-bound raytracers to name a few examples. These gains typically amount to about 15-20% at the very extreme end.

Normally those types of compute heavy processes, data streamlined, processes don’t see much benefit from SMT. After all SMT only provides a performance benefit by allowing the CPU to pull from two distinct chains of instructions, and fill the pipeline gaps from one thread, with instructions from the other thread. It’s effectively instruction-by-instruction scheduling of two different threads.

But if you’re running an optimised and efficient process that doesn’t have significant unpredictable branching, or significant unpredictable memory operations. Then SMT offers you very little because the instruction pipeline for each thread is almost fully packed, offering few opportunities to schedule instructions from a different thread.

Re: New speculative attacks on Apple CPUs

#212

Is the statement from Apple just PR or is this not a usable exploit? "Based on our analysis, we do not believe this issue poses an immediate risk to our users." https://www.bleepingcomputer.com/news/security/new-apple-cpu...

Apple PR, which is unlike them; to wave it off.

Re: New speculative attacks on Apple CPUs

#213
post #192
post #187

Earlier quoted context omitted.

Yes, in some special cases , which both embedded/opened and embedding/opening websites can avoid by setting the appropriate HTTP headers/HTML attributes. Of course it would be better if Safari would do the same thing as Chrome and Firefox and just provide a separate process for all contexts, including those that can communicate per specifications. But there's something sites can do today to avoid this potential infor…

> websites can avoid by setting the appropriate HTTP headers/HTML attributes. Individual sites plugging browser + CPU security holes seems like a violation of separation of concerns. Yes, I hope every bank out there puts this workaround into their site ASAP, but that's hardly a solution for the flaw itself.

The permanent solution to the flaw is either a hardware/OS-side fix (i.e. disabling this particular kind of speculation via a chicken bit, if there is one), or Safari implementing site isolation in the same way Chrome and Firefox are already doing.

But as the former might well be impossible (at least without ruining performance or requiring a hardware swap), and the latter might take a while, websites should still take the precautions they can. It's a good idea for other reasons anyway: Why keep around an inter-context messaging mechanism you possibly don't even need?

Re: New speculative attacks on Apple CPUs

#214

Earlier quoted context omitted.

If just visiting a webpage with some JS will let them do ACE on even 0.1% of visitors, hackers are probably still motivated enough to try it. But I vaguely remember these kinds of vulns can be patched in-browser for a perf hit instead of taking the hit system-wide, which sounds like an ok compromise. Edit: Arbitrary memory access, not ACE

>hackers are probably still motivated enough to try it. The amount of actual exploit crafting that is needed to actually do something meaningful with a hack is pretty much not worth doing for any financial reason. The only time this happens now is when state funded actors or prominent groups with lots of manpower really want to take down an individual person.

Depends how automated it can be. I know some non-spectre 0-days were used broadly, either via viruses or port-scanning. Is it possible to craft some JS that'll use a spectre-like vuln to reliably grab something important like Chrome passwords or credit cards? Idk, it's hard to prove otherwise, and hackers have more time to think about this than I do.

Re: New speculative attacks on Apple CPUs

#215
post #34
post #18

Their SLAP demo provides a great example of how defence-in-depth can make/break the viability of an exploit. That terrifying Safari demo is possible because Safari fails to isolate new windows in individual processes when calling `window.open` in js. All the other side channel magic presented here doesn't matter if the data you want to read is in a seperate process with sufficient separation from the "hostile" proces…

That's not a failure of Safari, it's required by window.open API semantics, in particular by the default Cross-Origin-Opener-Policy of "unsafe-none" [1]. By setting a different policy, sites can protect themselves against this. I guess technically browsers could open new windows in a new browsing context group regardless of this setting and relay the allowed types of messages via IPC (if any), but that would be a maj…

Can't edit my original post anymore: Firefox and Chrome do seem to isolate even same-browsing-context-group and bridge the required APIs via IPC, so hopefully Safari will catch up at some point.

Basically, there are three scenarios:

- Completely unrelated tabs (e.g. those you open manually, those opened via command-click, tabs opened via '" or 'rel="noopener"' references etc.) – these are relatively easily isolated if the browser supports it at all. All major (desktop!) browsers now largely do this, including Safari.

- "Same browsing context group" (but different origin) sites. These can communicate via various APIs, and historically that was achieved by just letting them run in the same rendering process. But in the face of attacks such as this one, this can be insecure. Firefox and Chrome provide sandboxing via separate processes; Safari does not.

- Same origin sites (without any stricter policy). These can fully access each other's DOM (if they have an opener/opened relationship), so there's not really any point in having them live in different renderers except possibly for fault isolation (e.g. one of them crashing not taking the other down). As far as I know, all browsers render these in the same process.

Sites can opt out of the second and third category into the first via various HTTP headers and HTML link attributes. If we were to design the web from scratch, arguably the default for window.open should be the first behavior, with an opt in to the second, but that's backwards compatibility for you.

Re: New speculative attacks on Apple CPUs

#216
post #34

Earlier quoted context omitted.

That's not a failure of Safari, it's required by window.open API semantics, in particular by the default Cross-Origin-Opener-Policy of "unsafe-none" [1]. By setting a different policy, sites can protect themselves against this. I guess technically browsers could open new windows in a new browsing context group regardless of this setting and relay the allowed types of messages via IPC (if any), but that would be a maj…

It is not required by window.open semantics, you can absolutely implement site isolation even in the presence of COOP unsafe-none

Sorry, I was imprecise in my original post: It's definitely possible to isolate even sites in the same browsing context group, but it requires more work that Safari apparently just hasn't got around to yet.

Re: New speculative attacks on Apple CPUs

#218
post #213
post #192

Earlier quoted context omitted.

> websites can avoid by setting the appropriate HTTP headers/HTML attributes. Individual sites plugging browser + CPU security holes seems like a violation of separation of concerns. Yes, I hope every bank out there puts this workaround into their site ASAP, but that's hardly a solution for the flaw itself.

The permanent solution to the flaw is either a hardware/OS-side fix (i.e. disabling this particular kind of speculation via a chicken bit, if there is one), or Safari implementing site isolation in the same way Chrome and Firefox are already doing. But as the former might well be impossible (at least without ruining performance or requiring a hardware swap), and the latter might take a while, websites should still ta…

> But as the former might well be impossible (at least without ruining performance or requiring a hardware swap), and the latter might take a while,

According to the site they informed Apple in May 2024. Should that not have been enough time?

Re: New speculative attacks on Apple CPUs

#219
post #87
post #31

Earlier quoted context omitted.

Do other browsers have process isolation for new tabs?

Not necessarily for tabs on the same web site, but for different sites, yes. Hence "site isolation".

To be fair, this is (relatively, compared to the age of the web) new behavior though.

Even Chrome, which pioneered the "tab per process" model, didn't isolate same browsing group context sites for a long time, and still shares processes on Android as a resource optimization: https://chromium.googlesource.com/chromium/src/+/main/docs/p...

Firefox only released their "Project Fission" in 2021, i.e. three years after Spectre.

Re: New speculative attacks on Apple CPUs

#220

> On the other hand, although Chrome is equipped with Site Isolation, we demonstrate that it is not a perfect mitigation. We show the real-world existence of corner cases, where two subdomains of the same site can be merged into one process, again leading to LAP- and LVP-based attacks. Did anyone spot where this is mentioned? Edit: it doesn’t seem like they have a general attack. Rather, it’s that some sites are not…

Right, and “where two subdomains of the same site can be merged into one process” is normal right, given Site Isolation ≠ Origin Isolation.

A PSL flaw is important, but also a low-cost fix.

Thanks for pointing this out.

Post reply on HN