MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs
1–10 of 118 posts
Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs
#2There are 4 separate vulnerabilities in MDS, not just the one reported in the ZombieLoad paper. They each have CVEs.
Chrome Browser response here: https://www.chromium.org/Home/chromium-security/mds
Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs
#3Hyper-Threading has been a source of security concerns for a decade now, and vulnerabilities in existing HT implementations have been trickling out over the last few years. Unlike Management Engine or TrustZone, at least we can disable Hyper-Threading (for a 30% performance hit).
Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs
#4For me as a home user, taking a performance hit of any kind in response to threats which haven't yet been seen in the wild simply isn't good math.
Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs
#5For me as a home user, taking a performance hit of any kind in response to threats which haven't yet been seen in the wild simply isn't good math.
I don't think that anybody can know whether this is true, since exploitation leaves little evidence. Even before this is witnessed in the wild for the first time, you can't really know which secrets of yours have already been exfiltrated.
Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs
#6The overview page, https://cpu.fail/ , is on Hacker News as https://news.ycombinator.com/item?id=19911715 .
Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs
#7There are 4 separate vulnerabilities in MDS, not just the one reported in the ZombieLoad paper. They each have CVEs. Chrome Browser response here: https://www.chromium.org/Home/chromium-security/mds
Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs
#8Hyper-Threading has been a source of security concerns for a decade now, and vulnerabilities in existing HT implementations have been trickling out over the last few years. Unlike Management Engine or TrustZone, at least we can disable Hyper-Threading (for a 30% performance hit).
The security concern is remote code execution via JS, and sharing processor time with other people you don't trust, right?
It should be up to the VM-as-a-service and browser vendors to flush the cache properly.
Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs
#9For me as a home user, taking a performance hit of any kind in response to threats which haven't yet been seen in the wild simply isn't good math.
It certainly doesn't feel good. But if the home market remained unpatched with a public POC, they would be attacked. The most likely avenue is by writing malicious web pages to steal bitcoin wallets, etc.
Re: MDS: Microarchitectural Data Sampling side-channel vulnerabilities in Intel CPUs
#10Am I reading correctly that this has been under embargo for over a year?