Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

raspberrypi.org

Post reply on HN
Print view View original

31–40 of 232 posts

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#31

Post by DrTung »

vinn124 wrote: post #14
SomeHacker44 wrote: post #4

This is a good overview of modern, superscalar, out-of-order, speculative CPUs that literally any programmer could easily understand. Recommended reading for every single engineer in the whole world (who doesn't already understand this stuff from reading source material e.g., Google Zero post).

agreed

Me too. Finally I understand how the leakage works: no actual reading of kernel memory is taking place.

Instead, the read-ahead/speculative logic causes one of two addresses in user space to be read, and thus placed in the cache. So, by reading both of them, and checking the time it took, the exploit can indirectly determine one bit (0 or 1) of kernel memory. Scary!

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#32

Post by tptacek »

This is great, but remember that it covers Meltdown, not Spectre. Meltdown is the more immediate disaster, but Spectre is the more batshit vulnerability. You really want to get your head around:

* The branch target injection variant of Spectre if you want to get a sense of how amazing this vulnerability is: you can spoof the branch predictor to trick a target process into running arbitrary code in its address space! This is crazy!

* The misprediction variant of Spectre if you want to get a hopeless feeling in the pit of your stomach, since the implications of mispredict are that certain kinds of programs are riddled with a new kind of side channel we didn't really grok until last week, and no upcoming microcode update seems to be in the offing.

You could probably use the same Python conceit to illustrate the other two attacks; someone might take a crack at that.

(I'm not disputing that the R-Pi's aren't vulnerable to Spectre).

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#33

Post by ksearch »

jtchang wrote: post #22

This is a fantastic read. Timing attacks are insidious and tend to crop it in the oddest places. I first learned of them when learning how to securely compare strings (used a lot with passwords). A naive implementation means that you can easily guess if a character is correct depending on how fast the compare function returns.

I believe that you now know that every time you do this(comparing passwords as Strings) a puppy dies!

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#35

Post by ant6n »

pslam wrote: post #17

The cores in (all versions of?) Raspberry Pi do speculatively execute. It's just that the window of opportunity is tiny - just a few cycles (and maybe up to twice that many instructions) - and there's (probably) no way to get an indirected side-effect. I wouldn't write off the ability to get a useful side-effect signal. The variants widely documented are not the only possible methods of inducing speculative side-effe…

Plus, the Raspberri Pi does have a BTAC (Branch Target Access Cache). Part of Spectre uses the fact that in many architectures the branch target cache is shared across the kernel/user boundary to create a side channel.

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#36

Post by claytonjy »

tptacek wrote: post #32

This is great, but remember that it covers Meltdown, not Spectre. Meltdown is the more immediate disaster, but Spectre is the more batshit vulnerability. You really want to get your head around: * The branch target injection variant of Spectre if you want to get a sense of how amazing this vulnerability is: you can spoof the branch predictor to trick a target process into running arbitrary code in its address space!…

I too would love to see the continuation you suggest. This was a great article, and I was sad to see it end, since I was hoping to grok a little more about the technical differences between Meltdown and Spectre.

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#37

Post by JdeBP »

styfle wrote: post #27

I understood everything up until the "suppose we flush our cache before executing the code" part which is probably the most important part. There was a comment below the article that explained this part a little further: > Imagine the value at the kernel address, which gets loaded into _w, was 0xabde3167. Then the value of _x is 0x100, and address user_mem[0x100] will end up in the cache. A subsequent load of user_me…

Yes, that is the this is left as an exercise for the reader part of the explanation. (-:

The remaining part is to iterate the process over all of the bits in the word, using different bitmasks. The resultant set of 0 or 1 results for each bit yields the complete word.

Then one iterates that whole process over all (useful) words in (mapped) kernel memory.

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#38

Post by ploxiln »

tptacek wrote: post #32

This is great, but remember that it covers Meltdown, not Spectre. Meltdown is the more immediate disaster, but Spectre is the more batshit vulnerability. You really want to get your head around: * The branch target injection variant of Spectre if you want to get a sense of how amazing this vulnerability is: you can spoof the branch predictor to trick a target process into running arbitrary code in its address space!…

This covers both Meltdown and Spectre.

> Both vulnerabilities exploit performance features (caching and speculative execution) common to many modern processors to leak data via a so-called side-channel attack. Happily, the Raspberry Pi isn’t susceptible to these vulnerabilities, because of the particular ARM cores that we use.

The reason why Spectre is not a problem is because there is no branch predictor in these simpler arm cores. Instructions are processed in parallel when possible, but not before dependencies, including branch decisions.

EDIT: under "What is speculation?" branch prediction is described. Then in the conclusion: "The lack of speculation in the ARM1176, Cortex-A7, and Cortex-A53 cores used in Raspberry Pi render us immune to attacks of the sort."

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#39

Post by lelandbatey »

I've done some cursory searching and not found anything, so I'll ask here: what mechanism is used to measure how long it takes to access a specific address in memory?

I assume there is some way to tell the CPU "when memory location X is read, store the current time in register Y" or some such thing. Could anyone share what that mechanism is?

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#40

Post by tptacek »

ploxiln wrote: post #38
tptacek wrote: post #32

This is great, but remember that it covers Meltdown, not Spectre. Meltdown is the more immediate disaster, but Spectre is the more batshit vulnerability. You really want to get your head around: * The branch target injection variant of Spectre if you want to get a sense of how amazing this vulnerability is: you can spoof the branch predictor to trick a target process into running arbitrary code in its address space!…

This covers both Meltdown and Spectre. > Both vulnerabilities exploit performance features (caching and speculative execution) common to many modern processors to leak data via a so-called side-channel attack. Happily, the Raspberry Pi isn’t susceptible to these vulnerabilities, because of the particular ARM cores that we use. The reason why Spectre is not a problem is because there is no branch predictor in these si…

I'm not arguing that R-Pi's are vulnerable to Spectre.
Post reply on HN