Reading privileged memory with a side-channel

Post by AnssiH » Thu, Jan 04, 2018, 5:40 AM UTC

lettergram wrote: post #192

digikata wrote: post #42

Earlier quoted context omitted.

So there's a bit of an unknown if AMD's most recent generation of processor has the Spectre vulnerability?

We know that the scariest attack "meltdown", cannot be reproduced on AMD or ARM chips at all[1]. The second attack "Spectre" is also greatly mitigated due the neural network predicting pathways for the application. Thus it's unlikely/less-likely that you'll be able to access other locations in memory[2]. However, it's definitely possible. [1] https://meltdownattack.com/meltdown.pdf [2] https://spectreattack.com/spect…

Post by brendangregg » Thu, Jan 04, 2018, 5:42 AM UTC

Pyxl101 wrote: post #309

Is there any information available about whether the Linux KPTI patch mitigates the ability to use eBPF to read kernel memory? I'm asking because eBPF seems to execute within the kernel, and KPTI seemed to be about unmapping kernel page table when userspace processes execute. Are there any mitigations to the eBPF attack vector?

Post by spotman » Thu, Jan 04, 2018, 5:49 AM UTC

Godel_unicode wrote: post #409

tanilama wrote: post #402

Earlier quoted context omitted.

> Spectre Spectre doesn't really care if it is cloud or bare metal. They are equally vulnerable unless disconnected from internet.

Pretty hard to have a neighbor vm execute Spectre on your same physical server if you have dedicated hardware. Add in that Spectre specifically is a js bug so in order to be vulnerable your server would need to execute untrusted JavaScript and I think we can assume the threat surface of this specific bug is smaller outside the cloud...

Post by Godel_unicode » Thu, Jan 04, 2018, 5:57 AM UTC

cthalupa wrote: post #414

Godel_unicode wrote: post #409

Earlier quoted context omitted.

Pretty hard to have a neighbor vm execute Spectre on your same physical server if you have dedicated hardware. Add in that Spectre specifically is a js bug so in order to be vulnerable your server would need to execute untrusted JavaScript and I think we can assume the threat surface of this specific bug is smaller outside the cloud...

I don't think you understand the bug here. 1) https://spectreattack.com/ : "Spectre tricks other applications into accessing arbitrary locations in their memory. " Spectre does not let you execute code in another guest 2) Spectre is not javascript specific. I am not sure why you think it is, beyond the fact a PoC was written in js

Post by asgioiobuio » Thu, Jan 04, 2018, 6:01 AM UTC

gervase wrote: post #134

wslh wrote: post #64

Has Google the best security team in the world? It seems like Google security is in a complete different league. I cannot imagine how this impacts companies handling fiat money or cryptocurrencies in the cloud like Coinbase in AWS.

Project Zero is very well known for things exactly like this. Partially, it's because they are incredibly talented, but there are also talented people in academia and in other security consultancies. The biggest difference with Project Zero is that their primary [0] goal is altruistic: find vulnerabilities, and let people who can fix them know (vs publishing papers, securing paying clients, auctioning zero-days, etc)…