Is this saying that AMD is affected? Is this the same as the Intel bug reported earlier?
Of the variants of the attack that can leak privileged memory, AMD is only impacted if a non-default kernel configuration is enabled: "BPF JIT"
Reading privileged memory with a side-channel
81–90 of 639 posts
Re: Reading privileged memory with a side-channel
#82[deleted]
Re: Reading privileged memory with a side-channel
#83"These vulnerabilities affect many CPUs, including those from AMD, ARM, and Intel, as well as the devices and operating systems running them." Curious. All other reports I've read state that AMD CPUs are not vulnerable.
Sounds like maybe SOME ARM and SOME AMD are implicated, especially since the Android ARM CPUs appear to be fine...
There aren't really any special Android ARM CPUs, maybe they are confident it doesn't really work on Android because it's very difficult to get the timing precision and low-level assembly sequences in Java/ART compiled code. Though I wonder how that squares up with JNI.
I think the key to the statement is in any case that you need to differentiate between what is possible on the processor architecture level when you have full software control, and what is possible on an operating system level, where 3rd party applications are further restricted in various arbitrary ways such as only allowed to use Java, limited access to high resolution timing primitives, etc. that can make practical exploitation impossible, even if the flaw is present.
It's difficult to reason about because it's hard to tell if you can manipulate a JIT runtime into generating the code you need for the exploit to work - and as the JavaScript implementations show, the answer is often "yes".
Re: Reading privileged memory with a side-channel
#84Earlier quoted context omitted.
Interesting. Quoting a fair-sized chunk for context: > So far, there are three known variants of the issue: > Variant 1: bounds check bypass (CVE-2017-5753) > Variant 2: branch target injection (CVE-2017-5715) > Variant 3: rogue data cache load (CVE-2017-5754) > During the course of our research, we developed the following proofs of concept (PoCs): > A PoC that demonstrates the basic principles behind variant 1 in us…
The paper from the other people who discovered this says the same thing: "We also tried to reproduce the Meltdown bug on several ARM and AMD CPUs. However, we did not manage to successfully leak kernel memory with the attack de- scribed in Section 5, neither on ARM nor on AMD." The general purpose attack that leaks kernel memory, the one that KAISER fixes, only seems to work on Intel CPUs. Intel's press release was m…
Well... reading further, below the details of the third POC, they say "Our research was relatively Haswell-centric so far. It would be interesting to see details e.g. on how the branch prediction of other modern processors works and how well it can be attacked."
So it seems like they tried it on AMD and ARM, but they tried much harder on Intel. That's less reassuring than my initial reading.
Re: Reading privileged memory with a side-channel
#85link for details for that from Project Zero: https://googleprojectzero.blogspot.com/2018/01/reading-privi...
Thanks! We've merged another thread and updated this link from https://security.googleblog.com/2018/01/todays-cpu-vulnerabi....
Re: Reading privileged memory with a side-channel
#86https://spectreattack.com/ Information site with some more information, and links to papers on the two vulnerabilities, called "Meltdown" and "Spectre" (with logos, of course). ( https://meltdownattack.com/ goes to the same site)
Both domains were registered on 2017-12-22. Given the planned disclosure on 9th January that Google mentions and MS and others coding patches silently [1], do the early reports [2] of kernel patches, does this mean that due to coding in the open the whole disclosure procedure has been vastly accelerated?
I wonder how the timing relates to New Year and many companies having holidays in CW1.
[1] https://lists.freebsd.org/pipermail/freebsd-security/2018-Ja...
Re: Reading privileged memory with a side-channel
#87"Testing also showed that an attack running on one virtual machine was able to access the physical memory of the host machine, and through that, gain read-access to the memory of a different virtual machine on the same host." Holy shit.
Main/Big impacts are on the cloud computer. For home computer, standard office use, there is no impact at this point, right?
Until someone figures out how to exploit it using JavaScript. The speed this moves it could be any minute now.
Re: Reading privileged memory with a side-channel
#88someone should honestly do a press release like "Intel Bug not actually Intel only" or give this thing a neutral name to search for.
Variant 2 and Variant 3 are Intel only. They are the most concerning as they break VM space.
Re: Reading privileged memory with a side-channel
#89https://github.com/IAIK/meltdown 404's. I assume this is by intention? So full disclosure, but missing the code? Or is it somewhere else?
Re: Reading privileged memory with a side-channel
#90"Testing also showed that an attack running on one virtual machine was able to access the physical memory of the host machine, and through that, gain read-access to the memory of a different virtual machine on the same host." Holy shit.
This basically kills cloud computing for anything sensitive using shared hardware. In the short term this will actually be good for cloud providers because the demand for dedicated instances will shoot up as there is no short-term alternative.
[deleted]