Questions tagged [spectre]

A side-channel vulnerability affecting modern microprocessors that perform branch prediction like Intel, AMD, ARM, Sparc and PowerPC allowing user processes to read memory belonging to other processes. Affects Linux, OS X, and Windows. Published in January 2018.

Filter by
Sorted by
Tagged with
1
vote
1answer
50 views

are small SOC chips also affected by Meltdown and Spectre?

How can I find out, if given CPU is affected by the Meltdown and Spectre bugs ? My CPU is relatively older, and it is a SOC chip: AMD GX-412TC SOC I was not able to find, whether these chips also ...
3
votes
0answers
62 views

What kind of attacks can hardware level memory encryption protect from?

Both AMD and Intel have introduced memory encryption at the hardware level. AMD calls this Secure Memory Encryption (SME), with the Intel version being Total Memory Encryption (TME). What kind of ...
2
votes
1answer
452 views

Sacrificing 30% of my CPU performance (by disabling Hyper-Threading) to fully mitigate CPU vulnerabilities, necessary?

I used the spectre-meltdown-checker, version 0.42, without any option resulting in all-green results. But, in a help page, I found the --paranoid switch, which resulted in about a half of later CVEs ...
1
vote
0answers
50 views

How would one compare Cache Allocating Technology against MIT's Dynamically Allocated Way Guard for prevention of the Spectre side-channel Attack?

Upon research, I'm finding it difficult to identify a way to compare each solution. Is it correct in saying both solutions are software based? Therefore, could I compare overall PC perfomance with ...
3
votes
1answer
253 views

Do I need microcode update if I update Kernel?

There is a CPU vulnerability Microarchitectural Fill Buffer Data Sampling. I use a Linux OS and I think to fix Microarchitectural Fill Buffer Data Sampling you need to update intel microcode or ...
3
votes
1answer
118 views

How risky would it be to run a Linux kernel without Spectre and Meltdown patches on a regular desktop system?

What would happen if we adopted: https://make-linux-fast-again.com/ Assume the system is used for development and general browsing. Are there any cases of these vulnerabilities being exploited in ...
1
vote
1answer
137 views

Application level protection against Meltdown, Spectre, Foreshadow, Fallout. Zombieload

Is it possible to develop an application in such a way that its data in memory cant be stolen by recent attacks such as Meltdown, Spectre, Foreshadow, Fallout. Zombieload? All mitigations focus on ...
1
vote
0answers
58 views

Software mitigation for variant 3a (rogue system register read) and variant 4 (speculative store bypass)

AFAIK, all mitigable meltdown / spectre variants have software mitigation except for variant 3a and 4. Why is this the case? For variant 4, a straightforward software mitigation is to place lfence ...
2
votes
1answer
522 views

Is Meltdown/Spectre mitigation necessary in virtual machine as well as in hypervisor? [duplicate]

I am running virtual machines in kvm/qemu hypervisor. The hypervisor has Meltdown/Spectre mitigation enabled in kernel. Is it necessary that virtual machines have the Meltdown/Spectre mitigation ...
0
votes
0answers
90 views

Meltdown checker says AWS and Rackspace is vulnerable - Why?

Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with 7 of 8 variants OK (the failed one is apparently ...
1
vote
2answers
138 views

Can someone explain in layman terms how Spectre and Meltdown expose protected data

I'm working on a document about them and I think I understand it general what happens -> by exploiting the CPUs memory caching and speculative execution but I'm a little lost of how protected data is ...
1
vote
1answer
325 views

Mitigation of Spectre and Meltdown affecting host OS from guest OS (Virtualbox)

I don't know all the details of Spectre and Meltdown, but the way I understand it is that they allow reading from memory, not writing to it. Also, I read that at least Spectre can get out of the ...
0
votes
1answer
64 views

Do any speculative executation attacks affect ARMv7 CPUs?

Do we know if there are speculative execution attacks that affect ARMv7 CPUs at this time? Are there any theoretical risks that need further investigation?
14
votes
2answers
2k views

Are new AMD processors more secure than Intel ones?

Since the discovery of Meltdown and Spectre, CPU security has been compromised and trust to the main manufacturers reduced, particularly Intel. 8 months later I wonder, what CPUs are more secure at ...
2
votes
1answer
736 views

Privacy implications of Intel CPU backdoors [closed]

I didn't follow all the episodes about backdoors in Intel CPUs What can intelligence or law enforcement agencies potentially do on a computer equipped with a vulnerable Intel CPU (connected to the ...
5
votes
1answer
614 views

Can speculative execution on intel cpu be disabled?

In the light of all the recent Intel Vulnerabilities with speculative execution, can speculative execution be fully disabled to protect from all this vulnerabilities, from BIOS or OS kernel? Maybe ...
3
votes
1answer
302 views

How to fix Spectre variant 3a and variant 4?e

How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using ...
0
votes
1answer
112 views

Do Meltdown and Spectre affect other Intel products such as SSDs?

I've found a good deal on an Intel SSD but I don't want to worry about the security hole or the loss of performance from patching it.
2
votes
1answer
372 views

What is NetSpectre?

A new attack was revealed in a document titled NetSpectre: Read Arbitrary Memory over Network (PDF warning). I've seen a few non-technical writeups about the fact that it's a pretty slow attack: ...
-1
votes
2answers
109 views

Extracting passwords from recycled machine using Spectre and Meltdown

With Spectre and Meltdown, hackers can extract your password from the CPU cache. If I give someone my computer without the hard drive, can he extract my passwords through the CPU?
1
vote
0answers
235 views

Nessus ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)

I have a MS Server 2012 r2 running ArcServe 17.5, which uses MSSQL Server Express 2014. When Nessus runs a scan of this system, I am getting the plugin 105613 - ADV180002: Microsoft SQL Server January ...
2
votes
2answers
219 views

Should I wait until Spectre and Meltdown is fixed in hardware? [duplicate]

I have a Laptop that needs replacing due to age. I will be using this laptop for desktop use, including Office Apps, Development, Running VMs & Web Browsing. I will be using separation using ...
3
votes
1answer
315 views

Why is there no spectre local root exploit in circulation?

I heard that Spectre could be used to reveal arbitrary information from RAM and I imagine it should ultimately be possible to automate getting root this way. At the same time, quite a couple of months ...
0
votes
1answer
313 views

What is the attack vector for CVE-2018-3639 Speculative Store Bypass?

We use Web Application deployed on a CentOS server. Can the attack will be performed via a browser? Or the attacker need a physical access to the CentOS server? I cannot understand the attack vector ...
1
vote
1answer
79 views

Does Speculative Store Bypass Attack Require Assembly/Source Code Knowledge?

ok, so the gist of speculative store bypass attack to my understanding is that, cpu chooses the most frequent code path, bypass the if/else test and just assumes that it's true/false and then execute ...
3
votes
1answer
2k views

Compiling with GCC retpoline flags

As of version 8 (later backported to 7.3), GCC has added retpoline support [0]. While I understand that it is intended[citation needed] for use in kernel patching for Spectre (ie: [1][2]), that does ...
1
vote
0answers
177 views

What Spectre V2 patches fixes which vulnerabilties on Linux?

Let's assume I have a computer with a pre-Skylake Intel processor that doesn't have microcode mitigating the Spectre V2 attack. Then to my understanding, if the kernel and all user-space applications ...
3
votes
1answer
430 views

Meltdown and Spectre regarding Firewalls and Sandboxing [duplicate]

I don't deeply understand Meltdown and Spectre -- all I know is that they are basically keylogging-like vulnerabilities within the CPU, which bypass any application layer stuff; correct me if I'm ...
1
vote
2answers
195 views

What is the significance of Spectre and Meltdown?

Reading up on Spectre and Meltdown attacks again, I don't get why they were hyped so much. These are cache attacks that take advantage of the instruction pipeline processing implementation in ...
4
votes
1answer
659 views

Software mitigation for Spectre v2

I run Debian as my OS and Guix as my package manager. I also run (approximately) latest kernel built using Guix. According to spectre-meltdown-checker, my kernel has mitigation for v1, v2 and v3. ...
47
votes
3answers
15k views

Are new Intel CPUs vulnerable to Meltdown/Spectre?

Has Intel released any information about new processors? According to their advisory a number of processors are susceptible, but it says nothing about when new processors will be fixed. Also Meltdown ...
1
vote
2answers
143 views

What to do against Spectre-1, Sprectre-2 and Meltdown on Linux and Windows in 01/2018? [duplicate]

How to handle Spectre-1, Spectre-2 and Meltdown for now, in 01/2018? It can almost never be wrong to do the following Stay up to date with your browser and OS e.g. Linux kernel update Update anti-...
3
votes
1answer
415 views

Adobe Flash and Meltdown / Spectre

Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as ...
5
votes
1answer
203 views

AMD K8 processors may not be vulnerable to Spectre?

I've been chewing on this for a week or so. Thought I'd ask if it could be validated. My thoughts are based on reading the Spectre whitepaper and research on the AMD K8 microarchitecture, and haven't ...
6
votes
2answers
392 views

Spectre/Meltdown - Does memory deallocation erase the actual RAM contents?

The other day I've been thinking about Spectre and Meltdown and the ability of one process to access the memory of another. On my Linux system currently I have all JavaScript disabled to eliminate ...
1
vote
2answers
386 views

Spectre, Meltdown to read SSH keys

I've got a VPS running on Ubuntu, accessed through SSH, passwordless and with a public key. Can Spectre and Meltdown be used to compromise it in order to get access remotely eg by reading the private ...
7
votes
3answers
255 views

How can CPU designers prevent information leaks from speculated execution?

We know about short-term measures to mitigate the Meltdown and Spectre vulnerabilities in certain microprocessors where speculative execution has measurable effects on cache timings (mainly patches to ...
0
votes
1answer
188 views

Spectre - Code Optimization/Branch Training concept [closed]

Trying to load "a" (lowecase a) speculatively using Spectre. Was hinted here: Spectre PoC - Paper based - opposite results that the problem why it does not load speculatively, could be not ...
0
votes
1answer
116 views

Spectre PoC - Paper based - opposite results

After long discussion with this Question (Thanks for help!) Spectre Proof of Concept (PoC) Speculative Execution - Checking for value Came up with simple PoC based on Spectre paper. Seems to be ...
2
votes
2answers
195 views

Spectre on AMD K7 generation : exploitable, in the real world?

Considering AMD K7-family (Ahtlon XP...) 32-bit only processors, have there been any published exploits (viz "Spectre" type attacks) or indications that such would be even remotely possible in ...
3
votes
1answer
612 views

Spectre Proof of Concept (PoC) Speculative Execution - Checking for value

Inspired by this question and based on this: Why does me unpatched sytsem *appear* to be not vulenrable by Spectre? Figured out I will open a new question, instead of "polluting" somebody else ...
6
votes
1answer
325 views

Why does my unpatched system *appear* to not be vulnerable to Spectre?

Since the corresponding research papers offer quite explicit descriptions publicly, I suppose that publishing my code below is not considered as encouraging or endorsing exploits. Nevertheless, I am ...
52
votes
3answers
16k views

Is it true that meltdown and spectre were intended as debug tools?

I heard from a guy that's involved in low-level (assembler, C for drivers and OSes) programming, that meltdown and spectre weren't actually vulnerabilities discovered only so recently, but they were ...
36
votes
6answers
10k views

On Windows boxes, is patching for Spectre and Meltdown necessary?

From what I've read, Spectre and Meltdown each require rogue code to be running on a Windows box in order for attacks to take place. The thing is, once a box has rogue code running, it's already ...
2
votes
1answer
253 views

Spectre: Problem with Understanding POC - Reading data from cache

I understand the vulnerability (Spectre) and, in theory, what the PoC does. But I do not understand the part of the PoC, when it reads or identifys the data from the cache, between the lines 86 - 108. ...
14
votes
1answer
736 views

Is anyone seeing a performance decrease after applying recent kernel patch fixing Meltdown and Spectre? [closed]

Our company has a lot of CPU intensive operations on our servers, so the performance decrease is a concern for the organization. We did the benchmarks, and it seems that performance is almost not ...
-3
votes
1answer
124 views

Are PCs really vulnerable to Spectre type attacks due to virtual user space addressing? [duplicate]

Are Windows OS user programs vulnerable to Spectre and the other recent Intel flaws? Wouldn't the virtual memory assignment in Windows prevent such attacks, or their usefulness? Sorry if I miss ...
4
votes
2answers
248 views

Will patching a higher layer protect against the spectre/meltdown vulnerability in a lower layer?

The question I am about to ask is similar to the following question: Do I need to patch Linux for Meltdown/Spectre if the hypervisor has been patched, and I trust the guest? However, I would like to ...
13
votes
1answer
1k views

Was Meltdown/Spectre discovered in 1991 or 1995?

Wikipedia mentions this paper without going into details: The Intel 80x86 Processor Architecture: Pitfalls for Secure Systems: As mentioned in the preceding scenario, caches present potential for ...
4
votes
1answer
245 views

Are mitigations for Spectre and Meltdown needed in the VMs for dynamic languages other than JavaScript?

Mitigations for Spectre and Meltdown are being added to the JavaScript VMs in Chrome, Firefox, IE/Edge and WebKit. Are similar mitigations also needed in the VMs for other dynamic languages? For ...