https://spectreattack.com/
Information site with some more information, and links to papers on the two vulnerabilities, called "Meltdown" and "Spectre" (with logos, of course).
(https://meltdownattack.com/ goes to the same site)
Reading privileged memory with a side-channel
41–50 of 639 posts
Re: Reading privileged memory with a side-channel
#42Earlier quoted context omitted.
Links to descriptions of similar vulnerabilities in AMD and ARM processors would be very welcome.
Here's a list of what google tested: Intel(R) Xeon(R) CPU E5-1650 v3 @ 3.50GHz (called "Intel Haswell Xeon CPU" in the rest of this document) AMD FX(tm)-8320 Eight-Core Processor (called "AMD FX CPU" in the rest of this document) AMD PRO A8-9600 R7, 10 COMPUTE CORES 4C+6G (called "AMD PRO CPU" in the rest of this document) An ARM Cortex A57 core of a Google Nexus 5x phone [6] (called "ARM Cortex A57" in the rest of t…
So there's a bit of an unknown if AMD's most recent generation of processor has the Spectre vulnerability?
Re: Reading privileged memory with a side-channel
#43"AMD chips are affected by some but not all of the vulnerabilities. AMD said that there is a "near zero risk to AMD processors at this time." British chipmaker ARM told news site Axios prior to this report that some of its processors, including its Cortex-A chips, are affected." - http://www.zdnet.com/article/security-flaws-affect-every-int... * Edit: From https://meltdownattack.com/ Which systems are affected by Mel…
Another good article:
https://www.theregister.co.uk/2018/01/02/intel_cpu_design_fl...
"AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault."
Re: Reading privileged memory with a side-channel
#44does this mean the embargo is lifted?
https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...
Yes, this explains why it was lifted.
Re: Reading privileged memory with a side-channel
#45"Testing also showed that an attack running on one virtual machine was able to access the physical memory of the host machine, and through that, gain read-access to the memory of a different virtual machine on the same host." Holy shit.
This basically kills cloud computing for anything sensitive using shared hardware. In the short term this will actually be good for cloud providers because the demand for dedicated instances will shoot up as there is no short-term alternative.
Re: Reading privileged memory with a side-channel
#46"Testing also showed that an attack running on one virtual machine was able to access the physical memory of the host machine, and through that, gain read-access to the memory of a different virtual machine on the same host." Holy shit.
"Compute Engine customers must update their virtual machine operating systems and applications so that their virtual machines are protected from intra-guest attacks and inter-guest attacks that exploit application-level vulnerabilities."
"Compute Engine customers should work with their operating system provider(s) to download and install the necessary patches."
Re: Reading privileged memory with a side-channel
#47>running on the host, can read host kernel memory at a rate of around 1500 bytes/second,
I kinda get how it works now. They force a speculative execution to do something with a protected memory address, and then measure the latency to guess the content. They did not found a way to continue execution after a page fault as rumors were.
The fact that speculative execution branch can access protected memory, but not to commit its own computation results to memory in ia32 was known since pentium 3 times.
It was dismissed as "theoretical only" vulnurability without possible practical application. Intel kept saying that for 20 years, but here it is, voila.
The ice broke in 2016 when Dmitry Ponomarev wrote about first practical exploit scenario for this well known ia32 branch prediction artifact. Since then, I believe, quite a few people were trying all and every possible instruction combination for use in timing attack until somebody finally got one that works that was shown behind closed doors.
Edit: google finally added reference to Ponomarev's paper. Here is his page with some other research on the topic http://www.cs.binghamton.edu/~dima/
Re: Reading privileged memory with a side-channel
#48Is this saying that AMD is affected? Is this the same as the Intel bug reported earlier?
Re: Reading privileged memory with a side-channel
#49Do we know how news of this got out before the disclosure date?
Based on a link here yesterday, there was a patch to the Linux kernel and comments associated with it.
Re: Reading privileged memory with a side-channel
#50Earlier quoted context omitted.
Looks like everyone is vulnerable to arbitrary user memory reads, while Intel and ARM are vulnerable to arbitrary kernel memory reads as well.
Thanks for clarifying Mike, should be interesting to see how this actually pans out.
Not just user memory reads. AMD CPUs won’t speculate loads from userland code directly to kernel memory, ignoring privilege checks (“Meltdown”). But they are still subject to the “Spectre” attack, which can disclose kernel memory by taking advantage of certain code patterns (which normally would be harmless) in kernel code.