Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sandsifter: find undocumented instructions and bugs on x86 CPU

github.com

Post reply on HN
Print view View original

41–50 of 94 posts

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#41

Post by qb45 »

flopunctro wrote: post #33
dtx1 wrote: post #29

Earlier quoted context omitted.

I'm sure there are ways to read out a CPU Hang and reset if that happens, if necessary via external hardware^(I'm guessing)^(I don't actually know)

Some enterprise-grade server platforms already have this functionality, it's called a "watchdog". Linux supports this since (at least) 2.4. I've been using this with HP ProLiant servers and (for me, at least) it has always worked as intended. For more info, search "linux watchdog timer".

I think they are common on Intel systems, my old laptop with ICH7-M chipset has one.

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#42

Post by bluGill »

hellbanner wrote: post #32

Related: https://www.theregister.co.uk/2013/05/20/intel_chip_customiz... "Everybody hates the golden screwdriver upgrade approach, where a feature is either hidden or activated through software, but the truth of the matter is that chip makers have been doing this sort of thing for decades – and charging extra for it." ""We are moving rapidly in the direction of realizing that people want unique things and they are go…

Depends on how you count. Is the instruction that adds register one to register two and stores it in register three different from the instruction that adds register one to register two and stores it in register four? The only difference is the register the data is stored in after the add. I can argue this either way, and you should be able to as well (though you may find one side is a lot more compelling).

Really an undocumented instruction is just anything that isn't documented, it is good practice to leave some blank space in your instruction set so that you can implement the next feature that needs a new instruction. As such we expect to find millions of potential instructions: there is nothing there but the next CPU might have something.

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#43

Post by ericfrederich »

qb45 wrote: post #34
_wmd wrote: post #7

tl'dr of the slides: Found on one processor... instruction Single malformed instruction in ring 3 locks Tested on 2 Windows kernels, 3 Linux kernels Kernel debugging, serial I/O, interrupt analysis seem to confirm Unfortunately, not finished with responsible disclosure No details available [yet] on chip, vendor, or instructions He's found a new f00f bug, winter 2017 is going to be interesting :)

Observation: the length of the censored "XXX hardware bug" text on the slides matches neither Intel, AMD nor Transmeta. Unlikely to be VIA too. Either it's deception or perhaps some obscure low-end embedded vendor. edit: for the curious, it's "(redacted) hardware bugs" :)

"Obscure" enough to run Windows though

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#44

Post by pmarreck »

mcculley wrote: post #23

This is great. That a program can learn about and exploit the CPU on which it is running from unprivileged userspace reminds me of the notion in Charlie Stross' Accelerando of running a timing attack against the universe to learn about the virtual machine in which we are being simulated.

I believe there was also a Rick & Morty episode about this (of course...)

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#46

Post by vsviridov »

qubex wrote: post #35
mcculley wrote: post #23

This is great. That a program can learn about and exploit the CPU on which it is running from unprivileged userspace reminds me of the notion in Charlie Stross' Accelerando of running a timing attack against the universe to learn about the virtual machine in which we are being simulated.

I'd never heard of Charlie Stross or his Accelerando book. Thanks for mentioning that, it looks right up my hard-sci-fi alley.

Then definitely also check out the Quantum Thief trilogy, by Hannu Rajaniemi.

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#47

Post by rasz »

SAI_Peregrinus wrote: post #5

Christopher Domas does some very cool work. His System Management Mode exploit a few years back was quite nice. It will be interesting to see which processor it is that he found the ring 3 hard lockup instruction in...

He works for spooks - Battelle Memorial Institute, a long-time NSA/CIA contractor. One of the places that hires officially retired spies.

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#48

Post by bem94 »

hellbanner wrote: post #40
bem94 wrote: post #38

Earlier quoted context omitted.

>> "several million" undocumented instructions.. is that right? Bear in mind that doesnt really mean that there are several million operations / opcode mnemonics which are undocumented but each distinct instructions. It is more likely they are "loose" decodings of other instructions, where changing a single bit of the opcode still causes the CPU to decode the same instruction. Toy example: If I encode my (imaginary I…

Thanks. The scale is still hard to wrap my head around but I see what you're saying. Could this tool find hardware backdoors?

I guess that if there was a special "Open backdoor" instruction which was undocumented, then yes I guess it could find it.

Backdoors tend to be separate systems which pry into something larger though (like the intel managment engine being a small, separate core which probes the main system). This means you normally need other means of access to the system other than the standard instruction sequence. Again, the IME needed network access to be abused I think, rather than instructions running on the main processor itself.

Implementing backdoors is stupid. Opening / accessing them with an undocumented instruction is moronic, but distressingly possible.

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#49

Post by rfth »

_wmd wrote: post #7

tl'dr of the slides: Found on one processor... instruction Single malformed instruction in ring 3 locks Tested on 2 Windows kernels, 3 Linux kernels Kernel debugging, serial I/O, interrupt analysis seem to confirm Unfortunately, not finished with responsible disclosure No details available [yet] on chip, vendor, or instructions He's found a new f00f bug, winter 2017 is going to be interesting :)

If I was a betting man I would say ARM.

Re: Sandsifter: find undocumented instructions and bugs on x86 CPU

#50

Post by okreallywtf »

vsviridov wrote: post #46
qubex wrote: post #35

Earlier quoted context omitted.

I'd never heard of Charlie Stross or his Accelerando book. Thanks for mentioning that, it looks right up my hard-sci-fi alley.

Then definitely also check out the Quantum Thief trilogy, by Hannu Rajaniemi.

Seconded, in the beginning it almost has a fantasy vibe since what it describes for the most part is so advanced it almost seems magical, but stick with it because it is fantastic.
Post reply on HN