Another non-issue on non-Intel CPUs, like SPARC. Lovely.
ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
291–300 of 337 posts
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#292I just want to plug their course hardware security (at the VU University Amsterdam). It's an amazing course and it costs 1200 euro's for students who need to pay full price. I've learned a lot about Spectre, Meltdown and novel forms of cache attacks and Rowhammer when I took it.
Offtopic: Are you familiar with the AI departments/ courses (master) at VU? I have the opportunity to go but haven't decided yet. (Interested in human-centred and modern ML with neural networks)
Hey, yea I do have some familiarity. Send me an email to have a conversation, it's in my profile.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#293It takes one rouge/unpatched VM to run and scan threads randomly, undetected over a longer period of time, if not patched. With HT disabled potential hits become less likely, but still possible given time. Is virtualization on Intel dead now? Perhaps not. But, it's increasingly dangerous to use Intel for cloud services.
Interestingly AWS released a bulletin about MDS vulnerability but nothing about ZombieLoad yet. https://aws.amazon.com/security/security-bulletins/AWS-2019-...
CVE-2018-12130 is in the list of CVE's in your link. That is the ZombieLoad CVE. I hate these stupid names, they only confuse as shown by your comment.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#294Earlier quoted context omitted.
They are not for all kind of attacks. E.g. this new one can only be reproduced on Intel, not on AMD and ARM. If you want to ban speculative execution for everything, you need to make the case that it's a fundamental issue and not an implementation specific issue. Right now, that's not the case for many of these vulnerabilities.
As I understand it, the Intel only vulnerabilities, Foreshadow/L1TF, and this set which I've not looked at the details of yet, are targeting specific Intel features, and there's no reason to believe a similar focus on the other companies' products wouldn't also find unique problems. For example, the first version of Foreshadow went after the SGX enclave. Given how widespread Meltdown and Spectre bugs are, there's abs…
As you say, only the first Foreshadow attack went after SGX - it turned out to be a broader flaw that also affected OS page table protections more generally and could be used to attack process-OS and VM-hypervisor isolation. Those variants relied only on Intel's implementation of standard x86 paging, and they don't exist on AMD because they didn't implement it in the flawed way Intel did. That is, Foreshadow/L1TF is Intel-only not because it relies on an Intel-only feature, but because it's an Intel-specific implementation flaw. (Linux had to substantially rework its paging code to work around this.)
AMD don't seem to have commented on ZombieLoad yet, presumably because it's much newer and they didn't have pre-announcement info about it, but they've commented on the other two vulnerabilities announced today and explained that the reason they're not vulnerable is because the corresponding units in their CPUs don't allow speculative data access unless the access checks pass and their whitepaper seems to suggest the same is true of ZombieLoad: https://www.amd.com/system/files/documents/security-whitepap...
SGX does make for an easier and flashier demo for Foreshadow, though, so it makes sense that the researchers went after that target. They managed to recover the top-level SGX keys that all SGX security and encryption on the system relies on, something that I don't think anyone had ever managed before.
Also, as I've said elsewhere, Intel seems to speculatively leak data that shouldn't be accessible pretty much everywhere in their designs where memory is accessed.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#295What impact does this have in a multi-tenant cloud environment? I'm legitimately considering moving my security critical EC2 instances over to AMD-backed instance types right now.
I doubt that you both manage critical infrastructure on AWS and haven't read the AWS security bulletin.
https://aws.amazon.com/security/security-bulletins/AWS-2019-...
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#296Earlier quoted context omitted.
Maybe because Intel has shipped a thousand more SKUs and millions more CPUs with Meltdown than ARM, for which the Cortex-A75 was a new design, and IBM, which doesn't ship huge numbers of either POWER or mainframe CPUs??
Why would that make a difference? We're not talking about manufacturing defects, every single unit they sell has the problem, doesn't matter if they sell 10 or 10 million.
It makes a difference because Intel is a more attractive and more consequential target for researchers. AMD's market share in servers is minuscule and even declining a bit as of 19Q1 (?), and modest but increasing nicely in notebooks and desktops https://news.ycombinator.com/item?id=19916279, while IBM's POWER and mainframe systems are expensive to very expensive to access.
ARM is actually a good target with a number of their newest designs using out-of-order speculative execution with Spectre vulnerabilities and their owning mobile space outside of notebooks, one of the newest even being vulnerable to Meltdown, but the significant headline worthy instances tend to come in much more locked down devices. Speed is also an issue, everything else being equal, the faster the chip, the faster data exfiltration proofs of concept will work.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#297Earlier quoted context omitted.
You can't really find a good AMD workhorse laptop; all of them end up with some outdated 1080p displays at best :( There is like only one notebook with a decent HiDPI screen with Ryzen (some HP, but not a workhorse). There was also terrible problem with Mobile Ryzen drivers resolved only like a month ago.
1080p strikes me as the pinnacle of a workstation display for laptops right now since I highly doubt any productivity improvement from higher dpi is gonna beat out battery life in the vast majority of cases. Even in the one use case where it matters, 4k video production, theres a reasonable argument for using screens similar to what your consumers will use at least some of the time. Especially if it saves you money a…
>1080p strikes me as the pinnacle of a workstation display for laptops right now since I highly doubt any productivity improvement from higher dpi is gonna beat out battery life in the vast majority of cases.
Well... I went from a 1080p Thinkpad x260 to a 1440 Thinkpad Yoga X1 a year ago and honestly couldn't go back now.
It's mostly plugged into an external monitor and delivers 1440 resolution to it through DP, but even on a train I can work or 4-5 hours in 1440 resolution with no issue.
And it runs Fedora.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#298Earlier quoted context omitted.
> these flaws mostly affect Intel because they are the largest CPU manufacturer It doesn't have anything do to with how large Intel is. They have clearly made a more aggressive hardware design which has more corner cases to break. The designs are broken and microcode can patch some variants of these side channels but the overhead is becoming a problem. In this case it's not certain if microcode can address the proble…
It's undeniable that they've made aggressive hardware decisions, but... Intel dwarves their second largest competitor (AMD) in revenue by an order of magnitude... and remember, AMD sells GPUs as well. They are BY FAR the largest producer of CPUs for laptops, desktops, and servers. Note that on each of these platforms, arbitrary code execution is an issue. Now for phones? Less so. Aggressively locked down software can…
While it’s undeniably a more lucrative target, I still don’t think that is the explanation for the differences in vulnerability. Researchers have been working on the x86/amd64 family of devices for a very long time. Looking aside, many of the published exploits in the past have been against Via and AMD (older architectures).
Like others pointed out, the portability of an attack is usually tried shortly after a successful attack is found. In this case, the attacks have not been found to work elsewhere yet. I won’t count it out that it’s more effort but we’re looking at a timeline of research that spans a year after first reports were made to Intel, which is plenty of time to consider other chips. AMD’s specter problems are very real but much narrower while an entirely separate architecture like ARM shared a lot more of the attack surface with Intel, including Apple chips which you cite as locked down.
Your logic makes sense but the actual historical log of exploits I’ve seen does not seem to line up to explain the result. It only guarantees that researchers will try things against Intel chips first, but nothing about the exclusion of other chips.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#299Earlier quoted context omitted.
Me being a caveman who believes that technology is a hammer that still can be used to drive nails into building materials instead of our own heads, I'm longing for an Intermesh of simple networked 8-bit machines running on vanilla (no ARM core bonuses) FPGAs, with CPUs simple enough to be predictable and understood not by a select few superhumans in the world, but by a critical mass of people, and communication proto…
> Are there any massively parallel supercomputing tasks whose results couldn't be summarized and reduced to mere text, which is not too hard to move over the airgap manually? Video decoding? Games? You know, the major use cases for custom highly patented hardware design?
Yeah, I know. The entertaining use cases. I understand that entertainment is the dominant use case for computers and networks globally.
Well, if one can't live without gaming or video streaming, (s)he might just accept the security and privacy risks and indulge on. Gamers, for one, are already perfectly fine with installing invasive DRM clients and don't seem to care a slightest about that.
And video, if that's a movie, still can be transferred to a cinema on film or a hard drive. Other legit use cases for video? Education? Well, books had been succeeding in that for hundreds of years until recently, when predigested visualization trumped imagination. And it's still possible to print and burn DVDs, BDs etc, but alas, the purchase is many clicks more involved and costs more money than a single youtube click..
I'm pretty sure that every other use case for powerful and complex machines to remain networked is an entertaining one. Which is OK as people seem to be bored to death these days and insatiable of their remedies, but then security is the least problem for them.
Convenience and entertainment. Good intentions that pave the way to a well known place.
Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
#300Earlier quoted context omitted.
> Intel was also planning to wait for at least another 6 months before bringing this to light Of course, until the legally agreed date when they can dump shares so there’s no obvious proof that it’s insider trading. Isn’t that what (then) Intel CEO Brian Krzanich did after Meltdown/Spectre?
No. CPU vulns don’t affect Intel’s stock price.
Yes. Gamers like Intel because it's faster. Benchmarks are clear. :P