Questions tagged [cpu]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
70 views

Secure code makes exploitation easier with CPU vulnerabilities?

I researched CPU vulnerabilities in the past, such as Specter and Meltdown. I read that one of those attacks is made easier if the code is a certain way. I cannot remember if it was related to being ...
2
votes
1answer
63 views

Would an anti-virus software make any other processes consume more CPU?

Would an anti-virus software make any other processes that it scans to consume more CPU? We recently switched to a new Next-Gen, AI based Anti-Virus software. On couple of our Linux servers that runs ...
0
votes
0answers
83 views

Is it possible to debunk Intel Management Engine conspiracy theories using a data usage monitor device?

If there would be any backdoor in recent Intel CPU's, then it should send and receive data secretly. Isn't it possible to easily debunk this conspiracy theory by implementing a third physical device ...
2
votes
1answer
65 views

are small SOC chips also affected by Meltdown and Spectre?

How can I find out, if given CPU is affected by the Meltdown and Spectre bugs ? My CPU is relatively older, and it is a SOC chip: AMD GX-412TC SOC I was not able to find, whether these chips also ...
0
votes
0answers
80 views

Anti-Theft Mobile CPU

The newest Android phones use the Qualcomm Snapdragon 855 chipset with its TrustZone/TEE. The Android OS makes sure that a stolen phone, in its assembled form, is not usable. Does Trustzone further ...
2
votes
1answer
915 views

Sacrificing 30% of my CPU performance (by disabling Hyper-Threading) to fully mitigate CPU vulnerabilities, necessary?

I used the spectre-meltdown-checker, version 0.42, without any option resulting in all-green results. But, in a help page, I found the --paranoid switch, which resulted in about a half of later CVEs ...
0
votes
0answers
16 views

It it possible to have Ettercap spread its work across more than one thread?

Wondering if it's possible to have Ettercap split its processing work up across more than one thread, whether by a manual "jury-rigged" abstraction layer, or if there's a way/option to have it be ...
1
vote
0answers
57 views

How would one compare Cache Allocating Technology against MIT's Dynamically Allocated Way Guard for prevention of the Spectre side-channel Attack?

Upon research, I'm finding it difficult to identify a way to compare each solution. Is it correct in saying both solutions are software based? Therefore, could I compare overall PC perfomance with ...
2
votes
2answers
223 views

Can javascript damage data and hardware?

I once had a script looking like the one below: window.open("SameSiteUrl"); alert("spamspamspam"); it had some strange laggy effects... Anyways, a friend "pranked" me by running the script overnight....
1
vote
3answers
853 views

If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries? [closed]

I'm talking about the overflow flag that is used in some architectures like x86: https://en.wikipedia.org/wiki/Overflow_flag why aren't operating systems using this overflow flag to stop integer ...
1
vote
2answers
340 views

Are the CPU protection rings meant to protect against malicious programs or against unintentional programming mistakes?

I am trying to understand what is the purpose of the CPU protection rings (specifically user mode and kernel mode). I don't think that the CPU protection rings are meant to protect against malicious ...
2
votes
0answers
106 views

How dangerous is the ME on non-vPro CPUs?

I’ve seen plenty of Intel ME vulnerabilities and other security-related issues with the co-processor. However, most seem to be focusing on the extended ME features available on vPro CPUs, which allow ...
0
votes
1answer
58 views

The main things a cloud data center could inject into its hardware

So some cloud service providers like Amazon use custom hardware to improve different characteristics of their servers. This also means they can control the security better, because there is nothing ...
0
votes
0answers
49 views

If you buy a used hard drive or CPU, how to guarantee it doesn't have anything installed or running on it [duplicate]

Say you buy a used hard drive, or a computer (wondering about both cases, something that is just a drive for storage, and something that is an actual running chip). I am not interested in whether or ...
1
vote
2answers
191 views

Effects of new random Session token for each HTTP Request

On successful authentcation, a web application issues a session cookie that is a constant length string of apparently random hex characters. ...
0
votes
1answer
450 views

Data Execution Prevention X vs NX

My lecturer posted this in his slides and I have no idea what he is trying to say. I quote from his slide: Windows DEP = Data Execution Prevention Old “X” idea: must allow explicitly, current ...
0
votes
1answer
61 views

Security implications of running multiple virtual machines on shared CPU cores

Recently there has been the recommendation to disable hyperthreading. I was wondering if there is an increased risk of an attack or information disclosure when multiple virtual machines use the same ...
14
votes
1answer
4k views

New CVE-2018-5407 “PortSmash vulnerablity” in Intel CPU

I just heard in the news: Intel CPUs impacted by new PortSmash side-channel vulnerability. Is it as threatening as Meltdown/Spectre? Is it patched? What should we do to be safe? Does it affect AMD CPU'...
1
vote
0answers
122 views

Will More vCPU's and RAM Help Protect Against Some Smaller Scale DDoS Attacks?

Obviously having more vCPU's (virtual CPU's) and more RAM by them self won't be able to alone help stop and/or prevent a DDoS attack, but let's say after a DDoS attack is finished and/or slowing down ...
32
votes
7answers
24k views

If I know the CPU architecture of a target, can I send instructions embedded in an image?

Can I send instructions embedded in an image to a target, if I know his CPU architecture?
0
votes
1answer
74 views

Do any speculative executation attacks affect ARMv7 CPUs?

Do we know if there are speculative execution attacks that affect ARMv7 CPUs at this time? Are there any theoretical risks that need further investigation?
15
votes
2answers
2k views

Are new AMD processors more secure than Intel ones?

Since the discovery of Meltdown and Spectre, CPU security has been compromised and trust to the main manufacturers reduced, particularly Intel. 8 months later I wonder, what CPUs are more secure at ...
5
votes
1answer
689 views

Can speculative execution on intel cpu be disabled?

In the light of all the recent Intel Vulnerabilities with speculative execution, can speculative execution be fully disabled to protect from all this vulnerabilities, from BIOS or OS kernel? Maybe ...
1
vote
2answers
972 views

How protected mode in CPU is really implemented?

I know what is real and protected mode of cpu execution. But how CPU implements protected mode ? AFAIK cpu does everything what the program says it to do. Where is the protected mode behaviour ...
3
votes
2answers
264 views

Why are Protection Rings called rings?

Protection rings are different privilege levels granted to software, with the kernel being the most privileged, applications the least privileged, and drivers somewhere in between. My question is why ...
3
votes
1answer
312 views

How to fix Spectre variant 3a and variant 4?e

How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using ...
2
votes
2answers
348 views

What can give physical access to CPU?

If an attacker has an unlimited physical access to CPU, but does not have access to memory, including RAM, can he attack and gain access to the user's data? I heard the opinion that this is ...
-1
votes
2answers
116 views

Extracting passwords from recycled machine using Spectre and Meltdown

With Spectre and Meltdown, hackers can extract your password from the CPU cache. If I give someone my computer without the hard drive, can he extract my passwords through the CPU?
1
vote
1answer
81 views

Does Speculative Store Bypass Attack Require Assembly/Source Code Knowledge?

ok, so the gist of speculative store bypass attack to my understanding is that, cpu chooses the most frequent code path, bypass the if/else test and just assumes that it's true/false and then execute ...
1
vote
1answer
147 views

Do Spectre(-NG) and Meltdown affect Mill?

Given what is publicly known about the Mill CPU, would it be affected by Spectre(-NG) or Meltdown style attacks? Why/why not?
1
vote
0answers
177 views

What Spectre V2 patches fixes which vulnerabilties on Linux?

Let's assume I have a computer with a pre-Skylake Intel processor that doesn't have microcode mitigating the Spectre V2 attack. Then to my understanding, if the kernel and all user-space applications ...
8
votes
3answers
269 views

How can CPU designers prevent information leaks from speculated execution?

We know about short-term measures to mitigate the Meltdown and Spectre vulnerabilities in certain microprocessors where speculative execution has measurable effects on cache timings (mainly patches to ...
8
votes
1answer
1k views

Intel firmware/microcode updates that make processors “immune” to both Spectre and Meltdown?

Recently Intel has claimed the following in a press release (emphasis added): SANTA CLARA, Calif., Jan. 4, 2018 — Intel has developed and is rapidly issuing updates for all types of Intel-based ...
6
votes
2answers
1k views

Capability of microcode hacking?

Before Spectre and Meltdown, I've never heard of users updating microcode on a chip through firmware or otherwise. I actually thought it was written into the silicon and immutable. Now I'm seeing a ...
11
votes
2answers
547 views

Does recent Intel hardware mitigate Meltdown at the hardware level?

Recently a security researcher made the following claim via Twitter (emphasis added): If you're running Windows, I'm about to publish a tool that checks if you have the "Variant 3: rogue data cache ...
5
votes
2answers
1k views

Are VIA CPUs vulnerable to Spectre/Meltdown attacks?

I couldn't find any information about the recently published Spectre/Meltdown attacks affecting VIA CPUs. Are they also affected by this vulnerabilities?
5
votes
1answer
490 views

What was state of the art knowledge on security of speculative evaluation when it was introduced to Intel CPUs?

Many sources claim that almost all Intel x86 CPUs back to Pentium Pro are vulnerable to the Meltdown attack. Pentium Pro was introduced to the market in 1995. What was the state of the art knowledge ...
4
votes
3answers
850 views

Do the Spectre and Meltdown CPU bugs affect AMD in addition to Intel?

If a server or or PC is running AMD CPUs, will those be affected by the Spectre and/or Meltdown bugs currently effecting Intel chips? Why or why not? What makes it affect one and not the other? How ...
1
vote
2answers
483 views

How does the Intel CPU design flaw affect us? [closed]

Today, I saw this in the news. I'm hesitant to install the fix, because I've heard it would slow down IO 50%, which is not acceptable for me. But a guy said that the flaw allows JavaScript in the ...
5
votes
1answer
936 views

Does the main OS run “virtualised” under the ring -1 hypervisor?

After reading this answer which explains that modern CPUs have a ring -1 that is running a hypervisor on the CPU and handles vmenter & stuff, I am wondering: The main operating system, like the ...
4
votes
3answers
562 views

Understanding the scope of Intel hyperthreading errata KBL095

Recently, many motherboards supporting skylake or kabylake, got a uefi update described as cpu microcode security update for a specific Intel errata, described by Intel as : Short Loops Which Use AH/...
2
votes
1answer
1k views

Intel Management Engine vulnerabilities in CPUs without vPro

Intel Management Engine (ME) imposes a security risk (see here for example). As I understand ME is a part of Intel vPro. Does having an Intel CPU without vPro support mean ME is not fully functional ...
1
vote
0answers
268 views

Frequent heavy CPU load from firefox browser -> malware? [closed]

Since recently I started to get very heavy CPU load on my 64bit Debian 9.0 Cinnamon machine. I have all my packages up to date including Firefox-ESR. Often the load is so heavy that I can hear my CPU. ...
0
votes
3answers
341 views

Can OS protect us from backdoored CPU? [closed]

I was wondering if O.S. can act in such a way to hide from CPU what it is doing? I know that everything is computed only in CPU, but O.S. decides what that is, and keeps track of file system, etc. For ...