The mysterious case of the Linux Page Table Isolation patches • Hacker News Board

Re: The mysterious case of the Linux Page Table Isolation patches

#61

Post by jstanley » Mon, Jan 01, 2018, 6:30 PM UTC

preordained wrote: post #34

syshum wrote: post #10

Earlier quoted context omitted.

Ahh yes, Security through Obscurity that is always the best If no one talks about a security problem that makes it disappear

If you're taking off for vacation and forgot to lock your door, the best thing would be to go back and lock it. If you couldn't get the door locked right away for some reason, you probably wouldn't want the news of your unlocked door broadcast through your neighborhood... Obscurity actually is a layer of security. The mistake is is when people are dependent upon it.

But this isn't one persons' door that's unlocked. This is more like a company that shipped a faulty door lock and is trying to keep it secret until they can ship fixed doors to everybody.

Re: The mysterious case of the Linux Page Table Isolation patches

#62

Post by amluto » Mon, Jan 01, 2018, 6:30 PM UTC

revelation wrote: post #51

jaccarmac wrote: post #49

The kernels for Gentoo have been all over the place for the past few weeks. I'm running 4.12 at the moment, then the repos updated to 4.14, which wouldn't build for me, so I waited a week for genkernel to modernize. When I came back 4.14 had been marked unstable and 4.12 was masked, making 4.9 the latest supported kernel. Seems that whatever is happening is a Big Deal.

Thats because Gentoo decided to switch on a new compile flag, then didn't bother to test that the kernel still boots: https://lkml.org/lkml/2017/12/29/449

And, for reasons that are entirely unknown, the issue got worse due to one of the PTI patches (written by, and hence tentatively blamed on, yours truly). Presumably it caused some minor change in code generation causing GCC to go nuts.

FWIW, the compile flag that Gentoo enabled activates a seriously busted GCC feature, and I'm a bit surprised that Gentoo gets away with it in user code.

Re: The mysterious case of the Linux Page Table Isolation patches

#63

Post by dboreham » Mon, Jan 01, 2018, 6:31 PM UTC

kps wrote: post #58

brokensegue wrote: post #52

Earlier quoted context omitted.

maybe add more bits of ECC?

Or indeed any bits of ECC. The fact that Intel omits or disables it on most CPUs is shameful.

There's ECC inside the chips.

Re: The mysterious case of the Linux Page Table Isolation patches

#64

Post by tzs » Mon, Jan 01, 2018, 6:32 PM UTC

avian wrote: post #33

userbinator wrote: post #20

IMHO, with RowHammer, the hardware is broken and it will continue to be broken until users complain enough --- maybe to the point of absolutely refusing to buy --- that the manufacturers and designers stop thinking "works 99.9999999999% of the time" is good enough: https://news.ycombinator.com/item?id=12410274

Why would users refuse to buy hardware that works 99.9999999999% of the time when they apparently have no problem buying software that works 99% of the time? Radioactive decays and cosmic particles flipping bits give an upper bound for reliability. You are not going to see low-background packages and rad-hard chips in your iPhone.

Almost everything I've seen on error rates from radioactive decay and cosmic particles has been on servers in data centers.

I wonder if home systems are equally vulnerable, or if there is something about data center system design or facilities that make them more susceptible?

I ask because I had a couple of home desktop Linux boxes once, without ECC RAM, that were running as lightly loaded servers. I ran a background process on both that just allocated a big memory buffer, wrote a pattern into it, and then cycled through it verifying that the pattern was still there.

Based on the error rates I'd seen published, I expect to see a few flipped bits over the year (if I recall correctly) that I ran these, but I didn't catch a single one.

Later, I bought a 2008 Mac Pro for home, and 2009 Mac Pro for work (I didn't like the PC the office supplied), and used both of those to mid 2017. They had ECC memory, and I never saw any report when I checked memory status that they had ever actually had to correct anything.

So...what's the deal here? What do I need to do to see a bit flip from radiocative decay or cosmic rays on my own computer?

Re: The mysterious case of the Linux Page Table Isolation patches

#65

Post by syshum » Mon, Jan 01, 2018, 6:33 PM UTC

preordained wrote: post #34

syshum wrote: post #10

Earlier quoted context omitted.

Ahh yes, Security through Obscurity that is always the best If no one talks about a security problem that makes it disappear

If you're taking off for vacation and forgot to lock your door, the best thing would be to go back and lock it. If you couldn't get the door locked right away for some reason, you probably wouldn't want the news of your unlocked door broadcast through your neighborhood... Obscurity actually is a layer of security. The mistake is is when people are dependent upon it.

Your analogy is severely flawed as my door lock is under my control and I know about the risks (i.e it is unlocked) so I can take the steps I need to mitigate that risk

For your analogy to apply here it would be the manufacturer of the door lock having a master key stolen then not telling anyone about it until they have a new lock for you to buy from them, in the case of a lock I would want to know that the lock is useless even if there was not solution so I can mitigate the risk no simply continue locking it believing it to be secure

Re: The mysterious case of the Linux Page Table Isolation patches

#66

Post by neerajsi » Mon, Jan 01, 2018, 6:35 PM UTC

john_moscow wrote: post #45

>public NT kernels from as early as November have begun to implement the same technique. Does the author refer to ReactOS, or has Microsoft really open-sourced parts of the NT kernel?

Reverse engineers pretty much know how everything in NT works. Msft publishes enough symbols that it's even possible to automatically decompile much of the code. Something like page table splitting would be obvious.

Re: The mysterious case of the Linux Page Table Isolation patches

#67

Post by Asdfbla » Mon, Jan 01, 2018, 6:38 PM UTC

Just curious: Even after an attacker goes through all the effort of finding out the physical address of the memory location they want to manipulate, how would someone make sure to get an adjacent memory location to even attempt to execute the Rowhammer attack? And even then, the smallest memory units allocated are basically pages within page frames, right? So if your target memory row is within a physical page frame, does the RowHammer attack even work? (Since there's no adjacent row an attacker has access to then.)

Re: The mysterious case of the Linux Page Table Isolation patches

#68

Post by [deleted] » Mon, Jan 01, 2018, 6:38 PM UTC

jaccarmac wrote: post #49

The kernels for Gentoo have been all over the place for the past few weeks. I'm running 4.12 at the moment, then the repos updated to 4.14, which wouldn't build for me, so I waited a week for genkernel to modernize. When I came back 4.14 had been marked unstable and 4.12 was masked, making 4.9 the latest supported kernel. Seems that whatever is happening is a Big Deal.

[deleted]

Re: The mysterious case of the Linux Page Table Isolation patches

#69

Post by avh02 » Mon, Jan 01, 2018, 6:39 PM UTC

jstanley wrote: post #59

avh02 wrote: post #39

Earlier quoted context omitted.

No, but they prevent everybody with ill-intent from exploiting the issue en-masse

No they don't. They prevent everybody with ill intent who doesn't already know about it from finding out about it from the guys without ill intent . That's all.

would you say it prevents the small fry from having a big impact?

edit: I think the mirai botnet(s) had some sort of power struggle? avoiding propagating knowledge about it prevents it from being easily exploited by more actors.

Re: The mysterious case of the Linux Page Table Isolation patches

#70

Post by Waterluvian » Mon, Jan 01, 2018, 6:40 PM UTC

joncrane wrote: post #4

If true, this is pretty huge. As if the AWS "You blew through your budget" emails right around midnight of New Years were only an appetizer. Edit: AWS Spurious Budget Email Barrage: https://www.reddit.com/r/aws/comments/7ndvli/anybody_get_spu...

Oh so that's not just me?

I had a lingering account that cost me 3 cents a month. All of a sudden I get an email freaking out about all these alarm thresholds I'm blowing past. I just outright closed my entire account because trying to delete the offending S3 entities would fail without an error message.