Meltdown / Spectre Discussion

[Jailer]

Intel posts an arse-covering press release a few moments ago...

Of course they did, their stock is taking a hit.....

 

[cobrakiller58]

won't kernel rebuilds still affect AMD hardware even though they are not actually vulnerable to this flaw?

Edit:apparently people are looking to address that as well https://lkml.org/lkml/2017/12/27/2

 

[Nick2253]

AMD responded to Intel's not-so-subtle nudge that AMD's processors were also susceptible: https://www.barrons.com/articles/amd-says-near-zero-risk-to-its-chips-1515016135

 

[Nick2253]

And now the cat is out of the bag:

http://www.zdnet.com/article/securi...el-chip-since-1995-arm-processors-vulnerable/

https://spectreattack.com/

 

[jgreco]

AMD responded to Intel's not-so-subtle nudge that AMD's processors were also susceptible: https://www.barrons.com/articles/amd-says-near-zero-risk-to-its-chips-1515016135

Yeah, well, there's just other undiscovered bugs hanging around out there in the silicon. This effing thing has apparently been around since the days of the Pentium Pro, or 'round about two damn decades, and we're just finding out about it now. Betcha other silicon has similar undiscovered issues.

 

[jgreco]

And now the cat is out of the bag:

http://www.zdnet.com/article/securi...el-chip-since-1995-arm-processors-vulnerable/

https://spectreattack.com/

Well spin my nipple nuts and send me to Alaska.

 

[nightshade00013]

Which systems are affected by Meltdown?
Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

Which systems are affected by Spectre?
Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors.

Looks like everyone is affected in some way. But Intel trying to pass everything off is bad juju.

 

[Nick2253]

Well spin my nipple nuts and send me to Alaska.

 

[tvsjr]

Detailed POCs for both exploits... beware, this is NOT light reading:
https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html

 

[Ericloewe]

Small sigh of relief: Meltdown does not compromise the hypervisor in VMs.

Big gasp of fear: Spectre affects any viable modern CPU and doesn't have obvious solutions.

 

[jgreco]

Small sigh of relief: Meltdown does not compromise the hypervisor in VMs.

"compromise"? Well that's kind of playing with words.

https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html

 

[Ericloewe]

"compromise"? Well that's kind of playing with words.

https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html

It is a small sigh. "The boss can't make hide nor hair of these metric booby traps" small.

 

[rs225]

My read of the Xen advisory says Meltdown does compromise the memory of the hypervisor and other guests without their patch. They were mapping the entire physical memory into the VM(under 5TiB), and relying on the paging protections.

Good news: the Windows patch hasn't turned my desktop to molasses.

 

[garm]

Apparently Apple already patched meltdown

https://support.apple.com/en-us/HT208394

 

[Ericloewe]

Apparently, Intel can patch the hard part - Spectre - in microcode, to some extent*. Which makes it that much more confusing that they're not capable of issuing patches for Meltdown.

*Well, they're not fixing it. They're setting things up so that software can avoid some of the behavior, almost certainly with performance costs.

 

[rs225]

It sounds like Meltdown is OS-patch only(or new chips), while Spectre has partial microcode fix and some recompiling to use special instructions to protect areas of code vulnerable to branch prediction analysis.

I think the difference between the two is that meltdown is stealing data at rest, while Spectre is analyzing the more fluid behavior of instructions in another process. So, change the instructions.

 

[JoshDW19]

For anyone that's interested, Kris posted a comment on the FreeNAS subreddit in regards to these exploits.

"Rest assured we are all just as eager for a fix as you. We are working with our FreeBSD folks now and will hopefully have a release with the fixes in the near future. One of the bugs in particular is a particularly non-trivial problem and we want to avoid any major performance penalty, so we are trying to make sure it is fixed "right". We'll post more updated information as we have it. Thanks!"

https://www.reddit.com/r/freenas/comments/7o21us/meltdown_and_spectre_concerns/ds7bwui/

 

[jgreco]

I wonder who's going to be the first to leave a flaming bag of poop in the doorway at the Intel Museum.

 

[jgreco]

For anyone that's interested, Kris posted a comment on the FreeNAS subreddit in regards to these exploits.

Well it isn't really relevant to FreeNAS, except insofar as people will end up paying a performance penalty. FreeNAS systems generally don't have random untrusted code running on them, except perhaps in jails. Unfortunately, the problem still needs to be fixed upstream, where that isn't true, and the upstream fixes will impact FreeNAS downstream.

 

[Ericloewe]

One interesting possibility is to effectively trust non-jailed processes while treating jailed processes to their own, sanitized page tables.

It sounds like Meltdown is OS-patch only(or new chips), while Spectre has partial microcode fix and some recompiling to use special instructions to protect areas of code vulnerable to branch prediction analysis.

I think the difference between the two is that meltdown is stealing data at rest, while Spectre is analyzing the more fluid behavior of instructions in another process. So, change the instructions.

Well, Meltdown is a straightforward "hey, load the address given by whatever's at this other address" scheme that results in many non-AMD CPUs actually going far enough to load it into cache, regardless of whether it's meant to be accessible. It's then leaked from the cache by a timing attack.

Spectre seems to mostly focus (for now) on branch prediction, poisoning the branch predictor to take (or not) branches into regions that are to be leaked, causing interesting regions of memory to be loaded into cache - but with some elbow grease, this can be done by a process that does have the right to read said region. Again, the leak then happens through a cache timing attack.

Now that I think about it, the reason Meltdown probably doesn't get a microcode patch is likely to be a lack of internal registers to keep track of prefetches that haven't been validated yet. Lacking that information, large sections of the cache would probably need to be invalidated, causing significant slowdown in memory accesses.