Earlier quoted context omitted.
Link?
Text and patch start here: https://lkml.org/lkml/2018/1/3/780 Also, see Linus' response here: https://lkml.org/lkml/2018/1/3/797
Discussed at https://news.ycombinator.com/item?id=16066968
Reading privileged memory with a side-channel
511–520 of 639 posts
Re: Reading privileged memory with a side-channel
#512"Before the issues described here were publicly disclosed, Daniel Gruss, Moritz Lipp, Yuval Yarom, Paul Kocher, Daniel Genkin, Michael Schwarz, Mike Hamburg, Stefan Mangard, Thomas Prescher and Werner Haas also reported them; their [writeups/blogposts/paper drafts] are at" Does anyone have any color/details on how this came to be? A major fundamental flaw exists that affects all chips for ~10 years, and multiple inde…
There was a paper "A Javascript Side-Channel Attack on LLC" in 2015 which seem similar to me, maybe it drove some research toward timing/caching mechanism at the CPU level and its exploitation with a 'side channel' attack.
Re: Reading privileged memory with a side-channel
#513I wonder if the whole thing with enormously complex CPUs requiring deep pipelines which in turn requires complex speculation etc was a design mistake? Is there an alternative history where mainstream CPUs are equally fast with a dumber/simpler design?
What requires the complex speculation is not the pipeline depth, it's the memory access latency.
Consider the following simple C code: "if (arr[idx]) { ... }". Without speculation, the core must stall until the condition has been read from memory, which can be hundreds of cycles if it's not in the cache. With speculation, these wasted cycles are instead used to do some of the work from most probable side of the branch, so when the condition finally arrives from memory, there's less work left to do.
The pipeline depth only affects what happens when the speculation predicted the wrong way: since the correct way is not on the pipeline, it has to fill the pipeline from scratch.
Re: Reading privileged memory with a side-channel
#514Earlier quoted context omitted.
> Mitigation is to insert mfence instructions throughout jit generated sandboxed code making it very slow, ugh. Here's the synchronized announcement from Chrome/Chromium: https://sites.google.com/a/chromium.org/dev/Home/chromium-se... "Chrome's JavaScript engine, V8, will include mitigations starting with Chrome 64, which will be released on or around January 23rd 2018. Future Chrome releases will include additional…
The mitigations are to disable SharedArrayBuffer and severely round performance.now(). Not good that there aren’t other less intrusive ways to mitigate.
For some reason, performance.now() and even the performance profiler are capped at 1 milisecond precision on my machine, which make both pretty much useles. Can only get better for me. :|
Re: Reading privileged memory with a side-channel
#515As a side topic, are we really in a place that even vulnerabilities need branding and websites?
Why not? Those big security vulnerabilities are going to be discussed in years to come, might as well come up with something a little more catchy than CVE-2017-5753. I guess they could've gone with more descriptive names.
At least "spectre" and "meltdown" will be memorable even for non-technical people (who should probably be aware of the issue even if they don't understand the technical details). "Bounds check bypass" and "branch target injection" probably sound like random words stringed together for most people.
Re: Reading privileged memory with a side-channel
#516Re: Reading privileged memory with a side-channel
#517Earlier quoted context omitted.
After skimming the articles it sounds like a lot hinges on just how hard Spectre is to pull off in practice/in the wild. Anyone have any insights on that?
They say they can reliably read memory around 120kB/s with one vulnerability and 1kB/s with the other. It just works, all the time. Some of the PoC takes a few minutes to initialize. I'd say difficulty level is easy.
However, only one of the PoCs runs on AMD, and that doesn't cross process boundaries.
So how easy is it to turn that PoC into something I should worry about? Seems like browsers are the most affected by this scenario, but that also means harden the browser (separate process per page) and it might be difficult to exploit.
Re: Reading privileged memory with a side-channel
#518[deleted]
Re: Reading privileged memory with a side-channel
#519Mua ban nha dat Da Nang gia re dang la cum tu duoc rat nhieu nguoi tim kiem hien nay. http://bit.ly/lamthenaodehancheruirokhimuabannhadatbanggiayv...