Questions tagged [meltdown]
A side-channel vulnerability affecting Intel x86 and few ARM-based microprocessors allowing user processes to read memory belonging to the kernel. Affects various OSes like Linux, OS X, and Windows. Published in January 2018.
95
questions
3
votes
1
answer
802
views
Mitigation of Spectre and Meltdown affecting host OS from guest OS (Virtualbox)
I don't know all the details of Spectre and Meltdown, but the way I understand it is that they allow reading from memory, not writing to it. Also, I read that at least Spectre can get out of the ...
CommunityBot
- 1
2
votes
1
answer
622
views
Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?
In browsers, use of SharedArrayBuffer is restricted to sites with the following HTTP headers because otherwise it exposes vulnerabilities to Spectre and Meltdown.
Cross-Origin-Embedder-Policy: require-...
- 125
5
votes
1
answer
804
views
Reducing resolution of timers as mitigation against Meltdown and Spectre
I have read that Firefox' current mitigation against Meltdown and Spectre (from 57.x) consists of the following:
The resolution of performance.now() will be reduced to 20µs.
The ...
- 66.5k
16
votes
2
answers
3k
views
Are new AMD processors more secure than Intel ones?
Since the discovery of Meltdown and Spectre, CPU security has been compromised and trust to the main manufacturers reduced, particularly Intel. 8 months later I wonder, what CPUs are more secure at ...
- 66.5k
1
vote
2
answers
401
views
Are Haswell CPUs still secure? Do they still get microcode updates?
I have a Dell laptop with a Haswell CPU, and the recent Retbleed vulnerabilities made me think how vulnerable it is in general. The whitepaper implies Haswell quite a lot, but it wasn't tested. I keep ...
- 128k
3
votes
0
answers
143
views
How to select a CPU to buy for the best security?
Various versions of Spectre, Meltdown, Foreshadow and ZombieLoad make it quite the jungle trip to navigate which CPUs are affected, how to mitigate them.
Right now, my problem is that I need a new ...
- 131
1
vote
1
answer
156
views
Are CPU side-channel attacks still a concern on VPSs
I've been looking into getting a VPS to run an OpenVPN server on and a few other things. I've been speaking to a hosting company and they have sent me this screenshot to show they are protected ...
- 135k
1
vote
1
answer
293
views
Is protecting against Meltdown and Spectre on virtual servers actually possible?
I've been reading into the Meltdown and Spectre bugs recently and the issues they cause for virtualised servers, as memory in one VM can potentially be accessed by another user in a separate VM with ...
- 135k
0
votes
1
answer
245
views
Understanding the Meltdown vulnerability
I need to write a simple program that demonstrates a race condition. I picked the Meltdown vulnerability.
I want to clarify something. I'm following this explanation https://resources.infosecinstitute....
- 34.6k
1
vote
2
answers
144
views
Can a meltdown attack also violate data integrity of other processes or is it just violating data secrecy?
Can a meltdown attack also violate data integrity of other processes by obtaining different passwords or is it just violating data secrecy by reading data it is unauthorized to do?
CommunityBot
- 1
0
votes
1
answer
234
views
Are there any class of systems where it is safe to disable spectre and meltdown patches
I was not able to find a definite answer to the question whether it is safe to disable spectre and meltdown vulnerabilities but i could articles that suggests the defaults might be revisited & ...
- 199k
2
votes
1
answer
1k
views
Privacy implications of Intel CPU backdoors [closed]
I didn't follow all the episodes about backdoors in Intel CPUs
What can intelligence or law enforcement agencies potentially do on a computer equipped with a vulnerable Intel CPU (connected to the ...
- 66.5k
3
votes
1
answer
540
views
Is microcode physically able to mitigate Meltdown?
I am aware that there is no microcode fix for Meltdown available (it has already been answered in various questions), and that the only extant microcode patches (IBRS and IPBP) only help with one of ...
- 2,265
3
votes
2
answers
696
views
Why must Meltdown use probe array?
This is code snippet of Meltdown assembly language code:
1. ; rcx = kernel address, rbx = probe array
2. xor rax, rax
3. retry:
4. mov al, byte [rcx]
5. shl rax, 0xc
6. jz retry
7. mov rbx, ...
1
vote
0
answers
232
views
Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR
I'm trying to understand and perform the Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR. The author have released the proof-of-concept code.
I'm trying to run the attack on my Intel ...
- 111
0
votes
0
answers
126
views
Secure code makes exploitation easier with CPU vulnerabilities?
I researched CPU vulnerabilities in the past, such as Specter and Meltdown.
I read that one of those attacks is made easier if the code is a certain way. I cannot remember if it was related to being ...
- 3,931
54
votes
4
answers
15k
views
Spectre/meltdown on a GPU
Are GPUs vulnerable to spectre/meltdown attacks, since they have most of what makes CPUs attackable? Is there any information in the VRAM, that would cause trouble if it was stolen?
- 279
1
vote
1
answer
230
views
Application level protection against Meltdown, Spectre, Foreshadow, Fallout. Zombieload
Is it possible to develop an application in such a way that its data in memory cant be stolen by recent attacks such as Meltdown, Spectre, Foreshadow, Fallout. Zombieload? All mitigations focus on ...
CommunityBot
- 1
1
vote
1
answer
179
views
are small SOC chips also affected by Meltdown and Spectre?
How can I find out, if given CPU is affected by the Meltdown and Spectre bugs ?
My CPU is relatively older, and it is a SOC chip:
AMD GX-412TC SOC
I was not able to find, whether these chips also ...
- 29.6k
14
votes
3
answers
9k
views
Should Virtual Machines be patched for Meltdown and Spectre?
In Meltdown and Virtual Machines it was clarified that at least Spectre works crossing VMs. This of course means that the Hypervisor must be patched, but
Should the VM OS be patched as well?
Not ...
- 12.7k
1
vote
0
answers
121
views
How would one compare Cache Allocating Technology against MIT's Dynamically Allocated Way Guard for prevention of the Spectre side-channel Attack?
Upon research, I'm finding it difficult to identify a way to compare each solution. Is it correct in saying both solutions are software based? Therefore, could I compare overall PC perfomance with ...
- 315
6
votes
1
answer
387
views
How risky would it be to run a Linux kernel without Spectre and Meltdown patches on a regular desktop system?
What would happen if we adopted: https://make-linux-fast-again.com/
Assume the system is used for development and general browsing.
Are there any cases of these vulnerabilities being exploited in ...
CommunityBot
- 1
1
vote
0
answers
194
views
Software mitigation for variant 3a (rogue system register read) and variant 4 (speculative store bypass)
AFAIK, all mitigable meltdown / spectre variants have software mitigation except for variant 3a and 4. Why is this the case?
For variant 4, a straightforward software mitigation is to place lfence ...
- 182
1
vote
2
answers
275
views
Meltdown & UEFI
I've been trying to understand the risk of an unprotected BIOS being the victim of an UEFI attack using Meltdown and what the risks are compared to the bug being unpatched in the OS.
What is required ...
- 366
4
votes
1
answer
3k
views
Are Meltdown and Spectre exploitable on 32-bit Linux platforms?
All of the information I've seen thus far on Meltdown and Spectre explicitly reference 64-bit platforms. What about 32-bit (specifically RHEL/CentOS)? I would assume that's also vulnerable but can ...
- 1
13
votes
1
answer
1k
views
Are Meltdown and Spectre only exploitable with compiled code?
Is a system vulnerable where the only untrusted code is interpreted, JIT'd, or executed in a VM as bytecode?
Does it depend on the language? Compiler?
Or, do attacks depend on the attacker loading ...
- 1
2
votes
1
answer
3k
views
Is Meltdown/Spectre mitigation necessary in virtual machine as well as in hypervisor? [duplicate]
I am running virtual machines in kvm/qemu hypervisor. The hypervisor has Meltdown/Spectre mitigation enabled in kernel.
Is it necessary that virtual machines have the Meltdown/Spectre mitigation ...
- 572
26
votes
6
answers
18k
views
How do I check if KPTI is enabled on linux?
The Meltdown attack FAQ says that KPTI is the fix for linux. How do I check if KPTI is running/enabled?
- 34.6k
0
votes
0
answers
193
views
Meltdown checker says AWS and Rackspace is vulnerable - Why?
Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with
7 of 8 variants OK (the failed one is apparently ...
- 1,162
2
votes
2
answers
227
views
Can someone explain in layman terms how Spectre and Meltdown expose protected data
I'm working on a document about them and I think I understand it general what happens -> by exploiting the CPUs memory caching and speculative execution but I'm a little lost of how protected data is ...
- 34
8
votes
1
answer
640
views
Mitigating Meltdown by checking the faulting address in every page fault?
Short question
Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
CommunityBot
- 1
5
votes
1
answer
1k
views
Can speculative execution on intel cpu be disabled?
In the light of all the recent Intel Vulnerabilities with speculative execution, can speculative execution be fully disabled to protect from all this vulnerabilities, from BIOS or OS kernel?
Maybe ...
- 5,068
3
votes
1
answer
388
views
How to fix Spectre variant 3a and variant 4?e
How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using ...
- 7,955
0
votes
1
answer
181
views
Do Meltdown and Spectre affect other Intel products such as SSDs?
I've found a good deal on an Intel SSD but I don't want to worry about the security hole or the loss of performance from patching it.
- 46.4k
-1
votes
2
answers
199
views
Extracting passwords from recycled machine using Spectre and Meltdown
With Spectre and Meltdown, hackers can extract your password from the CPU cache. If I give someone my computer without the hard drive, can he extract my passwords through the CPU?
CommunityBot
- 1
1
vote
0
answers
414
views
Nessus ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)
I have a MS Server 2012 r2 running ArcServe 17.5, which uses MSSQL Server Express 2014. When Nessus runs a scan of this system, I am getting the plugin 105613 - ADV180002: Microsoft SQL Server January ...
- 15.6k
2
votes
2
answers
323
views
Should I wait until Spectre and Meltdown is fixed in hardware? [duplicate]
I have a Laptop that needs replacing due to age.
I will be using this laptop for desktop use, including Office Apps, Development, Running VMs & Web Browsing. I will be using separation using ...
CommunityBot
- 1
171
votes
3
answers
17k
views
Meltdown and Spectre Attacks
Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one.
Main concerns
What ...
- 7,955
3
votes
1
answer
665
views
Meltdown and Spectre regarding Firewalls and Sandboxing [duplicate]
I don't deeply understand Meltdown and Spectre -- all I know is that they are basically keylogging-like vulnerabilities within the CPU, which bypass any application layer stuff; correct me if I'm ...
CommunityBot
- 1
1
vote
2
answers
283
views
What is the significance of Spectre and Meltdown?
Reading up on Spectre and Meltdown attacks again, I don't get why they were hyped so much.
These are cache attacks that take advantage of the instruction pipeline processing implementation in ...
- 46.4k
-1
votes
2
answers
109
views
How bits/bytes are handled after performing Meltdown? [closed]
I understand how it works but for example after reading 4 bytes, how do it undertand if it was originally an integer or 4 different characters? Both of them could give a meaningfull result.
- 123
13
votes
1
answer
3k
views
How does Meltdown/Spectre impact Intel SGX?
I've been reading about Meltdown and Spectre today, and I'm wondering if they impact Intel SGX enclaves.
Now, my understanding of Meltdown is somewhat hazy, but AFAICT it does not impact secure ...
- 248
1
vote
1
answer
433
views
How can a userspace linux process refer to a kernel address?
I would like help understanding a particular aspect of meltdown.
My understanding is that the meltdown bug can be used for a userspace linux process to access kernel memory (indirectly, through a ...
- 66.5k
48
votes
3
answers
16k
views
Are new Intel CPUs vulnerable to Meltdown/Spectre?
Has Intel released any information about new processors?
According to their advisory a number of processors are susceptible, but it says nothing about when new processors will be fixed. Also Meltdown ...
- 2,265
3
votes
1
answer
374
views
Meltdown - PoC - Reading physical address with KASLR disabled does not work
Working with this PoC
https://github.com/IAIK/meltdown
Running it:
# ./secret
[+] Secret: Sample text
[+] Virtual address of secret: 0x4af528
[+] Physical address of secret: 0x172bc3528
[+] Exit ...
CommunityBot
- 1
2
votes
1
answer
1k
views
how did the meltdown attack break KASLR in 128 steps for a target machine with 8GB RAM with 40bit randomization on a 64bit machine?
In the meltdown official paper released the authors broke the KASLR with 128 steps at worse. Unable to understand how did they come down to that number
Paper for reference
- 34.6k
1
vote
2
answers
200
views
What to do against Spectre-1, Sprectre-2 and Meltdown on Linux and Windows in 01/2018? [duplicate]
How to handle Spectre-1, Spectre-2 and Meltdown for now, in 01/2018?
It can almost never be wrong to do the following
Stay up to date with your browser and OS e.g. Linux kernel update
Update anti-...
CommunityBot
- 1
3
votes
1
answer
480
views
Adobe Flash and Meltdown / Spectre
Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as ...
- 199k
4
votes
3
answers
970
views
Do the Spectre and Meltdown CPU bugs affect AMD in addition to Intel?
If a server or or PC is running AMD CPUs, will those be affected by the Spectre and/or Meltdown bugs currently effecting Intel chips?
Why or why not?
What makes it affect one and not the other? How ...
14
votes
1
answer
2k
views
Was Meltdown/Spectre discovered in 1991 or 1995?
Wikipedia mentions this paper without going into details: The Intel 80x86 Processor Architecture: Pitfalls for Secure Systems:
As mentioned in the preceding scenario, caches
present potential for ...
- 103