Questions tagged [spectre]

A side-channel vulnerability affecting modern microprocessors that perform branch prediction like Intel, AMD, ARM, Sparc and PowerPC allowing user processes to read memory belonging to other processes. Affects Linux, OS X, and Windows. Published in January 2018.

Filter by
Sorted by
Tagged with
165
votes
3answers
16k views

Meltdown and Spectre Attacks

Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one. Main concerns What ...
55
votes
4answers
15k views

Spectre/meltdown on a GPU

Are GPUs vulnerable to spectre/meltdown attacks, since they have most of what makes CPUs attackable? Is there any information in the VRAM, that would cause trouble if it was stolen?
52
votes
3answers
16k views

Is it true that meltdown and spectre were intended as debug tools?

I heard from a guy that's involved in low-level (assembler, C for drivers and OSes) programming, that meltdown and spectre weren't actually vulnerabilities discovered only so recently, but they were ...
47
votes
3answers
15k views

Are new Intel CPUs vulnerable to Meltdown/Spectre?

Has Intel released any information about new processors? According to their advisory a number of processors are susceptible, but it says nothing about when new processors will be fixed. Also Meltdown ...
36
votes
6answers
10k views

On Windows boxes, is patching for Spectre and Meltdown necessary?

From what I've read, Spectre and Meltdown each require rogue code to be running on a Windows box in order for attacks to take place. The thing is, once a box has rogue code running, it's already ...
24
votes
1answer
1k views

Which attacks are known that exploit the vulnerability known as Spectre?

As reported yesterday the Linux and Windows kernels will receive a security update pretty soon to close vulnerabilities that concern 'kernel memory leaking'. What exactly the design flaw is, that ...
20
votes
1answer
2k views

How can SharedArrayBuffer be used for timing attacks?

Since this new class of attacks involves measuring precise time intervals, as a partial, short-term, mitigation we are disabling or reducing the precision of several time sources in Firefox. The ...
19
votes
2answers
1k views

Just how bad is Spectre?

Reading the whitepaper, it sounds like doom and gloom. The main webpage states “Spectre is harder to exploit than Meltdown, but it is also harder to mitigate. However, it is possible to prevent ...
14
votes
3answers
7k views

Should Virtual Machines be patched for Meltdown and Spectre?

In Meltdown and Virtual Machines it was clarified that at least Spectre works crossing VMs. This of course means that the Hypervisor must be patched, but Should the VM OS be patched as well? Not ...
14
votes
1answer
736 views

Is anyone seeing a performance decrease after applying recent kernel patch fixing Meltdown and Spectre? [closed]

Our company has a lot of CPU intensive operations on our servers, so the performance decrease is a concern for the organization. We did the benchmarks, and it seems that performance is almost not ...
14
votes
2answers
2k views

Are new AMD processors more secure than Intel ones?

Since the discovery of Meltdown and Spectre, CPU security has been compromised and trust to the main manufacturers reduced, particularly Intel. 8 months later I wonder, what CPUs are more secure at ...
13
votes
1answer
1k views

Are Meltdown and Spectre only exploitable with compiled code?

Is a system vulnerable where the only untrusted code is interpreted, JIT'd, or executed in a VM as bytecode? Does it depend on the language? Compiler? Or, do attacks depend on the attacker loading ...
13
votes
1answer
1k views

Was Meltdown/Spectre discovered in 1991 or 1995?

Wikipedia mentions this paper without going into details: The Intel 80x86 Processor Architecture: Pitfalls for Secure Systems: As mentioned in the preceding scenario, caches present potential for ...
13
votes
1answer
2k views

How does Meltdown/Spectre impact Intel SGX?

I've been reading about Meltdown and Spectre today, and I'm wondering if they impact Intel SGX enclaves. Now, my understanding of Meltdown is somewhat hazy, but AFAICT it does not impact secure ...
9
votes
1answer
446 views

What does Spectre mean for public cloud computing?

From a tweetstorm by security journalist Nicole Perlroth: The most visceral attack scenario is an attacker who rents 5 minutes of time from an Amazon/Google/Microsoft cloud server and steals data ...
8
votes
1answer
1k views

Intel firmware/microcode updates that make processors “immune” to both Spectre and Meltdown?

Recently Intel has claimed the following in a press release (emphasis added): SANTA CLARA, Calif., Jan. 4, 2018 — Intel has developed and is rapidly issuing updates for all types of Intel-based ...
7
votes
3answers
260 views

How can CPU designers prevent information leaks from speculated execution?

We know about short-term measures to mitigate the Meltdown and Spectre vulnerabilities in certain microprocessors where speculative execution has measurable effects on cache timings (mainly patches to ...
7
votes
2answers
1k views

Can Javascript engines that run on the JVM be used to implement the Spectre exploit?

I see that Chrome and Mozilla have added mitigations into their javascript engines for the Spectre vulnerabilities (CVE-2017-5753 & CVE-2017-5715). However I cant find anything regarding ...
6
votes
3answers
901 views

Spectre and Meltdown being used in large scale attack on unpatched systems [closed]

Do we have to be worried about Spectre and Meltdown being used for a large scale attack like Wannacry? Even though the patches coming out are being deployed to a most recent systems, there will ...
6
votes
1answer
985 views

Is branch predictor flush instruction a complete Spectre fix?

I have understood that Spectre works mainly by exploiting the branch predictor state. Bounds check bypass and branch target injection are two faces of the same coin, the interaction of speculative ...
6
votes
2answers
403 views

Spectre/Meltdown - Does memory deallocation erase the actual RAM contents?

The other day I've been thinking about Spectre and Meltdown and the ability of one process to access the memory of another. On my Linux system currently I have all JavaScript disabled to eliminate ...
6
votes
2answers
509 views

Why do CPUs operate speculatively with results of forbidden memory fetches?

By my understanding, the Meltdown and Spectre attacks both exploit the fact that some modern processor, when given something like: if (x < arr1[y]) z = arr2[arr3[x]*256]; may sometimes fetch ...
6
votes
1answer
327 views

Why does my unpatched system *appear* to not be vulnerable to Spectre?

Since the corresponding research papers offer quite explicit descriptions publicly, I suppose that publishing my code below is not considered as encouraging or endorsing exploits. Nevertheless, I am ...
5
votes
6answers
956 views

what fails in speculative execution that allows the read of memory out of bounds in Spectre vulnerability vs. normal CPU behaviour?

Following google's Project zero blog entry for Spectre/Meltdown, there's this piece of code that exemplifies the attack: struct array { unsigned long length; unsigned char data[]; }; struct ...
5
votes
1answer
438 views

Why were Meltdown and Spectre disclosed at the same time?

Both the Meltdown and Spectre vulnerabilities were publicly disclosed on January 3, 2018. (6 days ahead of the originally planned January 9). Since their public reveal, there has been some confusion ...
5
votes
1answer
345 views

Can Spectre be fixed in future hardware simply by purging CPU caches?

As far as I understand it, Spectre is caused by speculative execution not completely undoing all side effects of an incorrect branch prediction (specifically, not undoing a CPU cache write). Doesn't ...
5
votes
2answers
1k views

Are VIA CPUs vulnerable to Spectre/Meltdown attacks?

I couldn't find any information about the recently published Spectre/Meltdown attacks affecting VIA CPUs. Are they also affected by this vulnerabilities?
5
votes
1answer
2k views

Do I need to patch Linux for Meltdown/Spectre if the hypervisor has been patched, and I trust the guest?

If I'm running a VM on Amazon EC2 or Microsoft Azure, and they've patched the underlying hypervisor, do I need to upgrade my Linux kernel to protect against Meltdown or Spectre? Assume that I'm not ...
5
votes
1answer
631 views

Can speculative execution on intel cpu be disabled?

In the light of all the recent Intel Vulnerabilities with speculative execution, can speculative execution be fully disabled to protect from all this vulnerabilities, from BIOS or OS kernel? Maybe ...
5
votes
1answer
204 views

AMD K8 processors may not be vulnerable to Spectre?

I've been chewing on this for a week or so. Thought I'd ask if it could be validated. My thoughts are based on reading the Spectre whitepaper and research on the AMD K8 microarchitecture, and haven't ...
4
votes
2answers
517 views

Why and where was Meltdown made public before schedule for the first time?

Originally, Meltdown and Spectre had a coordinated disclosure date of January 9, 2018. Some vendors were preparing to release fixes at that time, and were caught by surprise when the vulnaribilities ...
4
votes
3answers
832 views

Do the Spectre and Meltdown CPU bugs affect AMD in addition to Intel?

If a server or or PC is running AMD CPUs, will those be affected by the Spectre and/or Meltdown bugs currently effecting Intel chips? Why or why not? What makes it affect one and not the other? How ...
4
votes
3answers
2k views

A POWER7 processor on IBM i is currently vulnerable to Meltdowm or Spectre [duplicate]

All the updates on available linux systems have already been made. But I also have an IBM i (AS400) server, I have not heard in the news. But obviously it is more lucrative for news channels to ...
4
votes
2answers
414 views

What is the relationship between the GPZ research titles and Meltdown and Spectre?

I learned today that there were three vulnerabilities reported by Google Project Zero: bounds check bypass, branch target injection and rogue cache data load. Here is the AMD response to them: https://...
4
votes
1answer
3k views

Are Meltdown and Spectre exploitable on 32-bit Linux platforms?

All of the information I've seen thus far on Meltdown and Spectre explicitly reference 64-bit platforms. What about 32-bit (specifically RHEL/CentOS)? I would assume that's also vulnerable but can ...
4
votes
1answer
670 views

Software mitigation for Spectre v2

I run Debian as my OS and Guix as my package manager. I also run (approximately) latest kernel built using Guix. According to spectre-meltdown-checker, my kernel has mitigation for v1, v2 and v3. ...
4
votes
1answer
249 views

Are mitigations for Spectre and Meltdown needed in the VMs for dynamic languages other than JavaScript?

Mitigations for Spectre and Meltdown are being added to the JavaScript VMs in Chrome, Firefox, IE/Edge and WebKit. Are similar mitigations also needed in the VMs for other dynamic languages? For ...
4
votes
1answer
553 views

Reducing resolution of timers as mitigation against Meltdown and Spectre

I have read that Firefox' current mitigation against Meltdown and Spectre (from 57.x) consists of the following: The resolution of performance.now() will be reduced to 20µs. The ...
4
votes
2answers
250 views

Will patching a higher layer protect against the spectre/meltdown vulnerability in a lower layer?

The question I am about to ask is similar to the following question: Do I need to patch Linux for Meltdown/Spectre if the hypervisor has been patched, and I trust the guest? However, I would like to ...
4
votes
2answers
306 views

What is the expected performance impact/loss of meltdown/spectre patches? [duplicate]

The patches related to the mitigation of meltdown and spectre attacks, have they caused significant and noticeable slow down of execution in systems they have been applied to?
4
votes
1answer
376 views

Can I disable access to JS APIs in the browser such as highres timers?

In the wake of recent news of CPU bugs like Meltdown and Spectre which rely on precise(-ish) measurments of elapsed time, I find myself in the mood for disabling things like window.performance.now() ...
3
votes
2answers
870 views

How are exploits like Meltdown and Spectre noticed? [closed]

From the brief research that I have done both Meltdown and Spectre were primarily found by the same person (Jann Horn (Google Project Zero)). How are such exploits normally noticed/found?
3
votes
1answer
1k views

Could Meltdown/Spectre be exploited from C#/.Net (or other managed languages or the Midori OS)?

First off yes the correct answer is patch your OS/system. That aside: Does the memory managed features of a language like C# prevent it from being used to exploit the Meltdown security bug? What ...
3
votes
1answer
313 views

Are MCUs (Like arduinos) effected by Meltdown?

I am curious if Microcontrolers are effected by the vulnerabilities of Meltdown and Spectre. These devices are not specifically CPUs, and do not run Operating Systems per-say. I'm not really sure I ...
3
votes
1answer
418 views

Adobe Flash and Meltdown / Spectre

Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as ...
3
votes
1answer
264 views

Do I need microcode update if I update Kernel?

There is a CPU vulnerability Microarchitectural Fill Buffer Data Sampling. I use a Linux OS and I think to fix Microarchitectural Fill Buffer Data Sampling you need to update intel microcode or ...
3
votes
1answer
125 views

How risky would it be to run a Linux kernel without Spectre and Meltdown patches on a regular desktop system?

What would happen if we adopted: https://make-linux-fast-again.com/ Assume the system is used for development and general browsing. Are there any cases of these vulnerabilities being exploited in ...
3
votes
1answer
311 views

How to fix Spectre variant 3a and variant 4?e

How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using ...
3
votes
1answer
2k views

Compiling with GCC retpoline flags

As of version 8 (later backported to 7.3), GCC has added retpoline support [0]. While I understand that it is intended[citation needed] for use in kernel patching for Spectre (ie: [1][2]), that does ...
3
votes
1answer
226 views

Are Meltdown and Spectre complementary and used together

Meltdown and Spectre have both been announced at the same time, almost always in the same sentence. Is there a connection, other than timing and the fact that they attack chips? Are they used together ...