Live data from Hacker News

More Intel speculative execution vulnerabilities

mdsattacks.com

261–262 of 262 posts

Re: More Intel speculative execution vulnerabilities

#261

Earlier quoted context omitted.

If this is your scenario, the attacker runs in its own emulator. A fairly thick pair of gloves, but not enough to prevent exploiting speculative execution vulnerabilities and reaching outside the emulator to poke into other processes. As another comment points out, attacks from Javascript code that escape the browser sandbox have been demonstrated, which is exactly your sandboxing scenario minus the easy part of targ…

> attacks from Javascript code that escape the browser sandbox have been demonstrated As far as I understand you still need to be able to have some kind of timing information or cpu state available in the sandboxed program, which is possible if the emulator/sandbox runs close enough to the metal (Such as a js program in a modern browsee, because they need to be fast). Remove ALL timing info and it should be possible…

I need to reiterate that optimism ("remove all timing info...") has no place in information security.

If you think you have removed all timing information sources you are aware of, many remain: those you aren't aware of at all, those you failed to recognize as exploitable, those you didn't actually remove by mistake, those that are degraded but still present... The attacker should be assumed to be clever and knowledgeable; as the saying goes, creating a system that you don't know how to crack is easy.

Re: More Intel speculative execution vulnerabilities

#262
post #137

Earlier quoted context omitted.

AMD processors were also vulnerable to spectre v2. I don't know the status of the mitigations or whether it was fixed in zen 2. EDIT: I found the list I made a few months back. no guarantees, but i think it is mostly accurate. Meltdown: Intel, IBM, some ARM Spectre v1: Intel, ARM, IBM, AMD Spectre v2: Intel, ARM, IBM, AMD Spectre v3a: Intel, ARM Spectre v4: Intel, ARM, IBM, AMD L1TF: Intel, IBM Meltdown-PK: Intel Spe…

spectre v2, like v1, isn't one that is "fixable." The mitigations (retpoline & microcode updates) are essentially additions that are added in places where security checks are done to just disable speculation for that particular check. But you still have to choose when & where to use those or even if you opt to use them at all. There are no sweeping fixes for either v1 or v2, and there probably won't be for a long tim…

> But the positive news is that v1 & v2 only matter at all if you do in-process sandboxing of untrusted code.

I don't think this is accurate. It seems to be a widespread misunderstanding that started because the original proof of concept was within a single process. Spectre, before mitigations, allowed userspace to read kernel memory if appropriate gadgets in the kernel could be identified and exploited.

My understanding is the impact is only intra-process after mitigations.

Post reply on HN