Questions tagged [spectre]
A side-channel vulnerability from 2018, affecting modern microprocessors that perform branch prediction (such as Intel, AMD, ARM, Sparc and PowerPC), allowing user processes to read memory belonging to other processes. Affects Linux, OS X, and Windows.
95
questions
2
votes
1
answer
162
views
What does COEP do that CSP doesn't already do?
Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). ...
1
vote
2
answers
358
views
Are Haswell CPUs still secure? Do they still get microcode updates?
I have a Dell laptop with a Haswell CPU, and the recent Retbleed vulnerabilities made me think how vulnerable it is in general. The whitepaper implies Haswell quite a lot, but it wasn't tested. I keep ...
- 11
0
votes
1
answer
620
views
COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?
COOP: cross origin opener policy
COEP: Cross origin embedder policy
Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
- 283
3
votes
0
answers
140
views
How to select a CPU to buy for the best security?
Various versions of Spectre, Meltdown, Foreshadow and ZombieLoad make it quite the jungle trip to navigate which CPUs are affected, how to mitigate them.
Right now, my problem is that I need a new ...
- 131
1
vote
1
answer
142
views
Are CPU side-channel attacks still a concern on VPSs
I've been looking into getting a VPS to run an OpenVPN server on and a few other things. I've been speaking to a hosting company and they have sent me this screenshot to show they are protected ...
- 109
2
votes
1
answer
537
views
Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?
In browsers, use of SharedArrayBuffer is restricted to sites with the following HTTP headers because otherwise it exposes vulnerabilities to Spectre and Meltdown.
Cross-Origin-Embedder-Policy: require-...
- 123
1
vote
1
answer
227
views
Is protecting against Meltdown and Spectre on virtual servers actually possible?
I've been reading into the Meltdown and Spectre bugs recently and the issues they cause for virtualised servers, as memory in one VM can potentially be accessed by another user in a separate VM with ...
- 109
0
votes
1
answer
215
views
Are there any class of systems where it is safe to disable spectre and meltdown patches
I was not able to find a definite answer to the question whether it is safe to disable spectre and meltdown vulnerabilities but i could articles that suggests the defaults might be revisited & ...
- 101
2
votes
2
answers
210
views
What is the impact and threat of Spectre in Javascript?
If you have looked into this demo of Spectre in JavaScript: Did I get it right that only current site memory can be accessed, due to site isolation etc? I saw there is also an addon to detect attackts ...
- 977
1
vote
0
answers
218
views
Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR
I'm trying to understand and perform the Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR. The author have released the proof-of-concept code.
I'm trying to run the attack on my Intel ...
- 111
0
votes
0
answers
124
views
Secure code makes exploitation easier with CPU vulnerabilities?
I researched CPU vulnerabilities in the past, such as Specter and Meltdown.
I read that one of those attacks is made easier if the code is a certain way. I cannot remember if it was related to being ...
- 715
1
vote
1
answer
174
views
are small SOC chips also affected by Meltdown and Spectre?
How can I find out, if given CPU is affected by the Meltdown and Spectre bugs ?
My CPU is relatively older, and it is a SOC chip:
AMD GX-412TC SOC
I was not able to find, whether these chips also ...
- 2,129
4
votes
0
answers
231
views
What kind of attacks can hardware level memory encryption protect from?
Both AMD and Intel have introduced memory encryption at the hardware level. AMD calls this Secure Memory Encryption (SME), with the Intel version being Total Memory Encryption (TME).
What kind of ...
- 21.6k
4
votes
1
answer
4k
views
Sacrificing 30% of my CPU performance (by disabling Hyper-Threading) to fully mitigate CPU vulnerabilities, necessary?
I used the spectre-meltdown-checker, version 0.42, without any option resulting in all-green results. But, in a help page, I found the --paranoid switch, which resulted in about a half of later CVEs ...
- 1,647
1
vote
0
answers
120
views
How would one compare Cache Allocating Technology against MIT's Dynamically Allocated Way Guard for prevention of the Spectre side-channel Attack?
Upon research, I'm finding it difficult to identify a way to compare each solution. Is it correct in saying both solutions are software based? Therefore, could I compare overall PC perfomance with ...
- 11
3
votes
1
answer
569
views
Do I need microcode update if I update Kernel?
There is a CPU vulnerability Microarchitectural Fill Buffer Data Sampling.
I use a Linux OS and I think to fix Microarchitectural Fill Buffer Data Sampling you need to update intel microcode or ...
- 31
6
votes
1
answer
376
views
How risky would it be to run a Linux kernel without Spectre and Meltdown patches on a regular desktop system?
What would happen if we adopted: https://make-linux-fast-again.com/
Assume the system is used for development and general browsing.
Are there any cases of these vulnerabilities being exploited in ...
- 161
1
vote
1
answer
229
views
Application level protection against Meltdown, Spectre, Foreshadow, Fallout. Zombieload
Is it possible to develop an application in such a way that its data in memory cant be stolen by recent attacks such as Meltdown, Spectre, Foreshadow, Fallout. Zombieload? All mitigations focus on ...
- 1,820
1
vote
0
answers
191
views
Software mitigation for variant 3a (rogue system register read) and variant 4 (speculative store bypass)
AFAIK, all mitigable meltdown / spectre variants have software mitigation except for variant 3a and 4. Why is this the case?
For variant 4, a straightforward software mitigation is to place lfence ...
- 182
2
votes
1
answer
3k
views
Is Meltdown/Spectre mitigation necessary in virtual machine as well as in hypervisor? [duplicate]
I am running virtual machines in kvm/qemu hypervisor. The hypervisor has Meltdown/Spectre mitigation enabled in kernel.
Is it necessary that virtual machines have the Meltdown/Spectre mitigation ...
- 2,129
0
votes
0
answers
190
views
Meltdown checker says AWS and Rackspace is vulnerable - Why?
Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with
7 of 8 variants OK (the failed one is apparently ...
- 1,162
2
votes
2
answers
222
views
Can someone explain in layman terms how Spectre and Meltdown expose protected data
I'm working on a document about them and I think I understand it general what happens -> by exploiting the CPUs memory caching and speculative execution but I'm a little lost of how protected data is ...
- 123
3
votes
1
answer
784
views
Mitigation of Spectre and Meltdown affecting host OS from guest OS (Virtualbox)
I don't know all the details of Spectre and Meltdown, but the way I understand it is that they allow reading from memory, not writing to it. Also, I read that at least Spectre can get out of the ...
- 15.7k
0
votes
1
answer
185
views
Do any speculative executation attacks affect ARMv7 CPUs?
Do we know if there are speculative execution attacks that affect ARMv7 CPUs at this time? Are there any theoretical risks that need further investigation?
user115400
16
votes
2
answers
3k
views
Are new AMD processors more secure than Intel ones?
Since the discovery of Meltdown and Spectre, CPU security has been compromised and trust to the main manufacturers reduced, particularly Intel. 8 months later I wonder, what CPUs are more secure at ...
- 163
2
votes
1
answer
1k
views
Privacy implications of Intel CPU backdoors [closed]
I didn't follow all the episodes about backdoors in Intel CPUs
What can intelligence or law enforcement agencies potentially do on a computer equipped with a vulnerable Intel CPU (connected to the ...
- 21
5
votes
1
answer
1k
views
Can speculative execution on intel cpu be disabled?
In the light of all the recent Intel Vulnerabilities with speculative execution, can speculative execution be fully disabled to protect from all this vulnerabilities, from BIOS or OS kernel?
Maybe ...
- 153
3
votes
1
answer
384
views
How to fix Spectre variant 3a and variant 4?e
How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using ...
- 31
0
votes
1
answer
180
views
Do Meltdown and Spectre affect other Intel products such as SSDs?
I've found a good deal on an Intel SSD but I don't want to worry about the security hole or the loss of performance from patching it.
- 113
2
votes
1
answer
597
views
What is NetSpectre?
A new attack was revealed in a document titled NetSpectre: Read Arbitrary Memory over Network (PDF warning). I've seen a few non-technical writeups about the fact that it's a pretty slow attack:
The ...
- 145
-1
votes
2
answers
194
views
Extracting passwords from recycled machine using Spectre and Meltdown
With Spectre and Meltdown, hackers can extract your password from the CPU cache. If I give someone my computer without the hard drive, can he extract my passwords through the CPU?
- 53
1
vote
0
answers
412
views
Nessus ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)
I have a MS Server 2012 r2 running ArcServe 17.5, which uses MSSQL Server Express 2014. When Nessus runs a scan of this system, I am getting the plugin 105613 - ADV180002: Microsoft SQL Server January ...
- 11
2
votes
2
answers
321
views
Should I wait until Spectre and Meltdown is fixed in hardware? [duplicate]
I have a Laptop that needs replacing due to age.
I will be using this laptop for desktop use, including Office Apps, Development, Running VMs & Web Browsing. I will be using separation using ...
2
votes
1
answer
506
views
Why is there no spectre local root exploit in circulation?
I heard that Spectre could be used to reveal arbitrary information from RAM and I imagine it should ultimately be possible to automate getting root this way. At the same time, quite a couple of months ...
- 6,534
0
votes
1
answer
441
views
What is the attack vector for CVE-2018-3639 Speculative Store Bypass?
We use Web Application deployed on a CentOS server.
Can the attack will be performed via a browser?
Or the attacker need a physical access to the CentOS server?
I cannot understand the attack vector ...
- 1,479
1
vote
1
answer
125
views
Does Speculative Store Bypass Attack Require Assembly/Source Code Knowledge?
ok, so the gist of speculative store bypass attack to my understanding is that, cpu chooses the most frequent code path, bypass the if/else test and just assumes that it's true/false and then execute ...
- 281
5
votes
1
answer
3k
views
Compiling with GCC retpoline flags
As of version 8 (later backported to 7.3), GCC has added retpoline support [0]. While I understand that it is intended[citation needed] for use in kernel patching for Spectre (ie: [1][2]), that does ...
- 373
1
vote
0
answers
244
views
What Spectre V2 patches fixes which vulnerabilties on Linux?
Let's assume I have a computer with a pre-Skylake Intel processor that doesn't have microcode mitigating the Spectre V2 attack. Then to my understanding, if the kernel and all user-space applications ...
- 115
3
votes
1
answer
661
views
Meltdown and Spectre regarding Firewalls and Sandboxing [duplicate]
I don't deeply understand Meltdown and Spectre -- all I know is that they are basically keylogging-like vulnerabilities within the CPU, which bypass any application layer stuff; correct me if I'm ...
- 39
1
vote
2
answers
269
views
What is the significance of Spectre and Meltdown?
Reading up on Spectre and Meltdown attacks again, I don't get why they were hyped so much.
These are cache attacks that take advantage of the instruction pipeline processing implementation in ...
- 95
5
votes
1
answer
934
views
Software mitigation for Spectre v2
I run Debian as my OS and Guix as my package manager. I also run (approximately) latest kernel built using Guix. According to spectre-meltdown-checker, my kernel has mitigation for v1, v2 and v3.
...
- 182
48
votes
3
answers
16k
views
Are new Intel CPUs vulnerable to Meltdown/Spectre?
Has Intel released any information about new processors?
According to their advisory a number of processors are susceptible, but it says nothing about when new processors will be fixed. Also Meltdown ...
- 585
1
vote
2
answers
199
views
What to do against Spectre-1, Sprectre-2 and Meltdown on Linux and Windows in 01/2018? [duplicate]
How to handle Spectre-1, Spectre-2 and Meltdown for now, in 01/2018?
It can almost never be wrong to do the following
Stay up to date with your browser and OS e.g. Linux kernel update
Update anti-...
- 45
3
votes
1
answer
479
views
Adobe Flash and Meltdown / Spectre
Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as ...
- 4,623
5
votes
1
answer
281
views
AMD K8 processors may not be vulnerable to Spectre?
I've been chewing on this for a week or so. Thought I'd ask if it could be validated. My thoughts are based on reading the Spectre whitepaper and research on the AMD K8 microarchitecture, and haven't ...
user169329
6
votes
2
answers
638
views
Spectre/Meltdown - Does memory deallocation erase the actual RAM contents?
The other day I've been thinking about Spectre and Meltdown and the ability of one process to access the memory of another.
On my Linux system currently I have all JavaScript disabled to eliminate ...
- 161
1
vote
2
answers
547
views
Spectre, Meltdown to read SSH keys
I've got a VPS running on Ubuntu, accessed through SSH, passwordless and with a public key.
Can Spectre and Meltdown be used to compromise it in order to get access remotely eg by reading the private ...
- 2,483
9
votes
3
answers
343
views
How can CPU designers prevent information leaks from speculated execution?
We know about short-term measures to mitigate the Meltdown and Spectre vulnerabilities in certain microprocessors where speculative execution has measurable effects on cache timings (mainly patches to ...
- 1,220
0
votes
1
answer
249
views
Spectre - Code Optimization/Branch Training concept [closed]
Trying to load "a" (lowecase a) speculatively using Spectre.
Was hinted here:
Spectre PoC - Paper based - opposite results
that the problem why it does not load speculatively, could be
not ...
- 977
0
votes
1
answer
171
views
Spectre PoC - Paper based - opposite results
After long discussion with this Question (Thanks for help!)
Spectre Proof of Concept (PoC) Speculative Execution - Checking for value
Came up with simple PoC based on Spectre paper.
Seems to be ...
- 977