Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

cyberus-technology.de

Post reply on HN
Print view View original

31–40 of 337 posts

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#31

Post by jawnv6 »

philsnow wrote: post #23
wmf wrote: post #13

Earlier quoted context omitted.

I think it is definitely worth introspecting about the history. It has been known for over 20 years that sharing pretty much anything creates side channels but nobody knew how to reliably exploit them and it was assumed that side channels might never be exploitable. In recent years there has been massive progress in practical data extraction using side channels.

Theo (of OpenBSD) famously ranted about Intel's implementation of SMT/hyperthreading ~12 years ago https://marc.info/?l=openbsd-misc&m=118296441702631&w=2

you sure about that link? he's talking about a core that didn't have SMT and is ranting, in general, about errata existing and wildly misrepresenting their impact

never mind that most errata are conditional until the ucode patch load, but that particular rant has nothing to do with HT

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#32

Post by shrimp_emoji »

faissaloo wrote: post #18
jamiek88 wrote: post #5

9% hit potentially on performance in data center. Add in all the Spectre and meltdown mitigations and we have potentially lost nearly two generations of Intel performance increases. Just shows the hoops and tricks needed to keep making, on paper, faster processors year on year but without node shrinks to give headroom. 14nm++++ is played out.

I wonder at what point the hardware fix for these issues stop becoming worthwhile and if we'll see a resurgence of processors without speculative execution or any of these other speed ups.

Or open source RISC-Vs

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#34

Post by gnode »

ljlolel wrote: post #19
gmueckl wrote: post #14

These CPU flaws make it seem as if virtualization in the data center is becoming really, really dangerous. If these exploits continue to appear, the only way forward would be dedicated machines for each application of each customer. Essentially, this might be killing the cloud by 1000 papercuts because it loses efficiency and cost effectiveness and locally hosted hardware does not necessarily have to have all mitigat…

it increases cloud revenues because of slow downs in CPU, and people can't move off cloud because they're locked in and can't hire datacenter engineers anyway

Ultimately cloud providers don't want revenue, they want profit. Except in some perverse cases (like cost-plus-percentage contracts), it's not generally in a business's interests for their costs to go up.

Even if there's no opportunity to switch away, eventually you bleed your customers dry and put them out of business. You will typically always aim to price your offering at the equilibrium point where loss of custom increases faster than the increase in profit, and vice versa.

One situation in which an increase in your costs can be good, is if the same increase applies more to your competition. But, in this case multi-tenant cloud is hit harder than the competing alternative of private infrastructure.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#35

Post by gmueckl »

Tharkun wrote: post #26
gmueckl wrote: post #14

These CPU flaws make it seem as if virtualization in the data center is becoming really, really dangerous. If these exploits continue to appear, the only way forward would be dedicated machines for each application of each customer. Essentially, this might be killing the cloud by 1000 papercuts because it loses efficiency and cost effectiveness and locally hosted hardware does not necessarily have to have all mitigat…

Many years ago, OpenBSD's Theo De Raadt made a sneer at virtualization, saying something the lines of "they can't even build a secure system, let alone a secure virtualized system". I can't remember who he was referring to specifically, but we've certainly been seeing a lot of similar vulnerabilities.

Would be cool to see a source for that one. Theo de Raadt is a hardliner whom I don't always agree with, but I'd like to know how visionary he actually was in this case (quite a bit by the looks of it).

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#36

Post by jcoffland »

S_A_P wrote: post #21

This sentence killed me: "Daniel Gruss, one of the researchers who discovered the latest round of chip flaws, said it works “just like” it PCs and can read data off the processor. That’s potentially a major problem in cloud environments where different customers’ virtual machines run on the same server hardware." What are they saying here?

It should read:

> ...said it works “just like” in PCs

The number of mistakes in the Techcrunch article is atrocious.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#37

Post by gmueckl »

faissaloo wrote: post #18
jamiek88 wrote: post #5

9% hit potentially on performance in data center. Add in all the Spectre and meltdown mitigations and we have potentially lost nearly two generations of Intel performance increases. Just shows the hoops and tricks needed to keep making, on paper, faster processors year on year but without node shrinks to give headroom. 14nm++++ is played out.

I wonder at what point the hardware fix for these issues stop becoming worthwhile and if we'll see a resurgence of processors without speculative execution or any of these other speed ups.

My guess is that the performance loss from removing these features would make such CPUs less economical than strictly enforced separation between security domains on a hardware assignment and scheduling level. That is, just forget about having the same server run stuff from different contexts at the same time.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#38

Post by dexen »

Tharkun wrote: post #26
gmueckl wrote: post #14

These CPU flaws make it seem as if virtualization in the data center is becoming really, really dangerous. If these exploits continue to appear, the only way forward would be dedicated machines for each application of each customer. Essentially, this might be killing the cloud by 1000 papercuts because it loses efficiency and cost effectiveness and locally hosted hardware does not necessarily have to have all mitigat…

Many years ago, OpenBSD's Theo De Raadt made a sneer at virtualization, saying something the lines of "they can't even build a secure system, let alone a secure virtualized system". I can't remember who he was referring to specifically, but we've certainly been seeing a lot of similar vulnerabilities.

Here's the full Theo de Raadt quote from 2007 [1]:

"""> Virtualization seems to have a lot of security benefits.

You've been smoking something really mind altering, and I think you should share it.

x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit.

You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.

You've seen something on the shelf, and it has all sorts of pretty colours, and you've bought it.

That's all x86 virtualization is. """

[1] https://marc.info/?l=openbsd-misc&m=119318909016582

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#39

Post by gnode »

dooglius wrote: post #29
gmueckl wrote: post #14

These CPU flaws make it seem as if virtualization in the data center is becoming really, really dangerous. If these exploits continue to appear, the only way forward would be dedicated machines for each application of each customer. Essentially, this might be killing the cloud by 1000 papercuts because it loses efficiency and cost effectiveness and locally hosted hardware does not necessarily have to have all mitigat…

Well, dedicated machines for each security domain for each customer, a lot of the time it's fine for many applications to be in the same security domain.

Even this isn't enough. Sometimes mutually untrusted parties must exchange data (say you're running a trading platform, or a social network). You have to ensure every point of interaction between such parties is immune to timing attacks.

Re: ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs

#40

Post by t1amat »

gmueckl wrote: post #35
Tharkun wrote: post #26

Earlier quoted context omitted.

Many years ago, OpenBSD's Theo De Raadt made a sneer at virtualization, saying something the lines of "they can't even build a secure system, let alone a secure virtualized system". I can't remember who he was referring to specifically, but we've certainly been seeing a lot of similar vulnerabilities.

Would be cool to see a source for that one. Theo de Raadt is a hardliner whom I don't always agree with, but I'd like to know how visionary he actually was in this case (quite a bit by the looks of it).

I believe this is the source: https://marc.info/?l=openbsd-misc&m=119318909016582
Post reply on HN