Questions tagged [spectre]

A side-channel vulnerability affecting modern microprocessors that perform branch prediction like Intel, AMD, ARM, Sparc and PowerPC allowing user processes to read memory belonging to other processes. Affects Linux, OS X, and Windows. Published in January 2018.

Filter by
Sorted by
Tagged with
8
votes
1answer
1k views

Intel firmware/microcode updates that make processors “immune” to both Spectre and Meltdown?

Recently Intel has claimed the following in a press release (emphasis added): SANTA CLARA, Calif., Jan. 4, 2018 — Intel has developed and is rapidly issuing updates for all types of Intel-based ...
5
votes
1answer
438 views

Why were Meltdown and Spectre disclosed at the same time?

Both the Meltdown and Spectre vulnerabilities were publicly disclosed on January 3, 2018. (6 days ahead of the originally planned January 9). Since their public reveal, there has been some confusion ...
4
votes
2answers
517 views

Why and where was Meltdown made public before schedule for the first time?

Originally, Meltdown and Spectre had a coordinated disclosure date of January 9, 2018. Some vendors were preparing to release fixes at that time, and were caught by surprise when the vulnaribilities ...
4
votes
2answers
306 views

What is the expected performance impact/loss of meltdown/spectre patches? [duplicate]

The patches related to the mitigation of meltdown and spectre attacks, have they caused significant and noticeable slow down of execution in systems they have been applied to?
4
votes
1answer
556 views

Reducing resolution of timers as mitigation against Meltdown and Spectre

I have read that Firefox' current mitigation against Meltdown and Spectre (from 57.x) consists of the following: The resolution of performance.now() will be reduced to 20µs. The ...
2
votes
1answer
98 views

Meltdown and Spectre vs. dcache timing and dcache leak issues

I've heard an expert (or "expert") laugh the current focus on Meltdown and Spectre off by arguing that dcache timing and dcache leak issues have been known and around for years (so nothing new there .....
55
votes
4answers
15k views

Spectre/meltdown on a GPU

Are GPUs vulnerable to spectre/meltdown attacks, since they have most of what makes CPUs attackable? Is there any information in the VRAM, that would cause trouble if it was stolen?
3
votes
1answer
1k views

Could Meltdown/Spectre be exploited from C#/.Net (or other managed languages or the Midori OS)?

First off yes the correct answer is patch your OS/system. That aside: Does the memory managed features of a language like C# prevent it from being used to exploit the Meltdown security bug? What ...
20
votes
1answer
2k views

How can SharedArrayBuffer be used for timing attacks?

Since this new class of attacks involves measuring precise time intervals, as a partial, short-term, mitigation we are disabling or reducing the precision of several time sources in Firefox. The ...
3
votes
1answer
173 views

Clamping the array index - is this a good idea for the Javascript Spectre mitigation?

From the Spectre document I learned that the attack can be successful because the compiler generates a memory read instruction that refers to the invalid array index. And even though the instruction ...
3
votes
1answer
313 views

Are MCUs (Like arduinos) effected by Meltdown?

I am curious if Microcontrolers are effected by the vulnerabilities of Meltdown and Spectre. These devices are not specifically CPUs, and do not run Operating Systems per-say. I'm not really sure I ...
14
votes
3answers
7k views

Should Virtual Machines be patched for Meltdown and Spectre?

In Meltdown and Virtual Machines it was clarified that at least Spectre works crossing VMs. This of course means that the Hypervisor must be patched, but Should the VM OS be patched as well? Not ...
5
votes
6answers
966 views

what fails in speculative execution that allows the read of memory out of bounds in Spectre vulnerability vs. normal CPU behaviour?

Following google's Project zero blog entry for Spectre/Meltdown, there's this piece of code that exemplifies the attack: struct array { unsigned long length; unsigned char data[]; }; struct ...
6
votes
3answers
903 views

Spectre and Meltdown being used in large scale attack on unpatched systems [closed]

Do we have to be worried about Spectre and Meltdown being used for a large scale attack like Wannacry? Even though the patches coming out are being deployed to a most recent systems, there will ...
3
votes
1answer
226 views

Are Meltdown and Spectre complementary and used together

Meltdown and Spectre have both been announced at the same time, almost always in the same sentence. Is there a connection, other than timing and the fact that they attack chips? Are they used together ...
7
votes
2answers
1k views

Can Javascript engines that run on the JVM be used to implement the Spectre exploit?

I see that Chrome and Mozilla have added mitigations into their javascript engines for the Spectre vulnerabilities (CVE-2017-5753 & CVE-2017-5715). However I cant find anything regarding ...
165
votes
3answers
16k views

Meltdown and Spectre Attacks

Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one. Main concerns What ...
5
votes
2answers
1k views

Are VIA CPUs vulnerable to Spectre/Meltdown attacks?

I couldn't find any information about the recently published Spectre/Meltdown attacks affecting VIA CPUs. Are they also affected by this vulnerabilities?
3
votes
2answers
870 views

How are exploits like Meltdown and Spectre noticed? [closed]

From the brief research that I have done both Meltdown and Spectre were primarily found by the same person (Jann Horn (Google Project Zero)). How are such exploits normally noticed/found?
4
votes
1answer
3k views

Are Meltdown and Spectre exploitable on 32-bit Linux platforms?

All of the information I've seen thus far on Meltdown and Spectre explicitly reference 64-bit platforms. What about 32-bit (specifically RHEL/CentOS)? I would assume that's also vulnerable but can ...
6
votes
2answers
509 views

Why do CPUs operate speculatively with results of forbidden memory fetches?

By my understanding, the Meltdown and Spectre attacks both exploit the fact that some modern processor, when given something like: if (x < arr1[y]) z = arr2[arr3[x]*256]; may sometimes fetch ...
9
votes
1answer
446 views

What does Spectre mean for public cloud computing?

From a tweetstorm by security journalist Nicole Perlroth: The most visceral attack scenario is an attacker who rents 5 minutes of time from an Amazon/Google/Microsoft cloud server and steals data ...
4
votes
3answers
833 views

Do the Spectre and Meltdown CPU bugs affect AMD in addition to Intel?

If a server or or PC is running AMD CPUs, will those be affected by the Spectre and/or Meltdown bugs currently effecting Intel chips? Why or why not? What makes it affect one and not the other? How ...
13
votes
1answer
1k views

Are Meltdown and Spectre only exploitable with compiled code?

Is a system vulnerable where the only untrusted code is interpreted, JIT'd, or executed in a VM as bytecode? Does it depend on the language? Compiler? Or, do attacks depend on the attacker loading ...
5
votes
1answer
2k views

Do I need to patch Linux for Meltdown/Spectre if the hypervisor has been patched, and I trust the guest?

If I'm running a VM on Amazon EC2 or Microsoft Azure, and they've patched the underlying hypervisor, do I need to upgrade my Linux kernel to protect against Meltdown or Spectre? Assume that I'm not ...
4
votes
3answers
2k views

A POWER7 processor on IBM i is currently vulnerable to Meltdowm or Spectre [duplicate]

All the updates on available linux systems have already been made. But I also have an IBM i (AS400) server, I have not heard in the news. But obviously it is more lucrative for news channels to ...
6
votes
1answer
985 views

Is branch predictor flush instruction a complete Spectre fix?

I have understood that Spectre works mainly by exploiting the branch predictor state. Bounds check bypass and branch target injection are two faces of the same coin, the interaction of speculative ...
4
votes
1answer
377 views

Can I disable access to JS APIs in the browser such as highres timers?

In the wake of recent news of CPU bugs like Meltdown and Spectre which rely on precise(-ish) measurments of elapsed time, I find myself in the mood for disabling things like window.performance.now() ...
4
votes
2answers
414 views

What is the relationship between the GPZ research titles and Meltdown and Spectre?

I learned today that there were three vulnerabilities reported by Google Project Zero: bounds check bypass, branch target injection and rogue cache data load. Here is the AMD response to them: https://...
5
votes
1answer
345 views

Can Spectre be fixed in future hardware simply by purging CPU caches?

As far as I understand it, Spectre is caused by speculative execution not completely undoing all side effects of an incorrect branch prediction (specifically, not undoing a CPU cache write). Doesn't ...
13
votes
1answer
2k views

How does Meltdown/Spectre impact Intel SGX?

I've been reading about Meltdown and Spectre today, and I'm wondering if they impact Intel SGX enclaves. Now, my understanding of Meltdown is somewhat hazy, but AFAICT it does not impact secure ...
19
votes
2answers
1k views

Just how bad is Spectre?

Reading the whitepaper, it sounds like doom and gloom. The main webpage states “Spectre is harder to exploit than Meltdown, but it is also harder to mitigate. However, it is possible to prevent ...
1
vote
2answers
479 views

How does the Intel CPU design flaw affect us? [closed]

Today, I saw this in the news. I'm hesitant to install the fix, because I've heard it would slow down IO 50%, which is not acceptable for me. But a guy said that the flaw allows JavaScript in the ...
24
votes
1answer
1k views

Which attacks are known that exploit the vulnerability known as Spectre?

As reported yesterday the Linux and Windows kernels will receive a security update pretty soon to close vulnerabilities that concern 'kernel memory leaking'. What exactly the design flaw is, that ...

1 2