Hot answers tagged

33

The processors that were already announced and are about to be launched in the near future will still be vulnerable to both Spectre v2 and Meltdown if patches and/or firmware is not applied correctly. Spectre v1 was not entirely fixed with the latest patches. Most recent products have patches available, although not always functioning very well. You can ...


26

Only Meltdown is specifically an Intel vulnerability / design flaw. update: it seems AMD is mostly resilient to Spectre. It's not clear why that would be the case. But according to AMD: (from early January, now replaced, see update 2 below) Differences in AMD architecture mean there is a near zero risk of exploitation of this variant. ...


23

As with a lot of breaking-news coverage of computer security, there's a lot of questionable reporting on PortSmash. It's not actually very interesting, as it doesn't really add much to the attacker toolkit. It only affects a very narrow set of targets, which are already vulnerable to other attacks (and have been for years). Colin Percival actually described ...


12

The state of the art was non-existent. At the time of the Pentium Pro, the World Wide Web was four years old. Widespread use of shared hosting was about ten years in the future; if you suggested that people would want to run untrusted code provided by random third parties, they'd look at you like you'd grown a second head. Memory protection was about ...


10

AMT is is hardly a secret. It is a feature for IT departments to get pseudo-console access to PCs over the network and remotely manage them. (The common term is Out of Band or OOB management.) It is comparable to HP’s iLO or Dell’s iDRAC, which are for servers. In the case of servers, there is usually a dedicated NIC for OOB. For desktops, that is not ...


9

They are both about equally terrible and still highly vulnerable to Spectre. Unfortunately, you would have to have access to confidential design documents in order to even begin answering this question. From (quasi-privileged) anecdotal evidence, AMD used to be really bad with setting lock bits (MMIO/MSR defaults, if I recall correctly), whereas Intel puts ...


7

Spectre works by causing the CPU to speculatively execute code selected by the attacker in the context of the target process. It does this by getting the branch predictor to guess incorrectly about which way an upcoming branch instruction will go, then looking for side effects of the code whose execution was discarded. Any CPU that performs speculative ...


7

It’s all speculation at this point. Normally, the 9th gen of Intel’s CPUs should be protected from the meltdown bug, and that generation is scheduled for the second half of 2018 (according to HKEPC). But that generation of CPUs was already quite ahead in development when the bug was found so it's quite likely that 9th gen will also be affected, in which case ...


6

My current understanding is that the microcode update changes the behavior of the obsolete VERW instruction so that it causes a flush of various internal processor buffers The new behavior of the VERW instruction is described in this article. In particular: The VERW instruction retains the same existing functionality, i.e., it checks whether the ...


5

Intel will release patches for all processors that are not older than 5 years. Most of these patches will be provided within the next week, the rest until the end of January 2018. They also released this pdf and this should answer all further questions regarding these patches. TL;DR: Mitigation for: Bounds Check Bypass (=Spectre): Software modifications ...


5

The Spectre and Meltdown attacks are about programs reading data they're not supposed to. They don't provide any way to make modifications or take control of computers. If you're running a typical desktop system, the flaws aren't a major threat simply because anyone in a position to use them has so many other ways to do the same thing. The real risk is to ...


5

Are new intel CPUs vulnerable to Meltdown/Spectre? When software mitigation protections are not correctly implemented new Intel CPUs are vulnerable to both Meltdown and Spectre. Has intel released any information about new processors? In an investors call Intel indicated that they are "working to incorporate silicon-based changed to future products that ...


4

The short answer is: Yes, but only if you need to be that secure. The side-channel vulnerabilities are a variety of ways that software can determine what data exists in places that it should not have access to---either by reading it directly or by inference. There are a variety of approaches to prevent this, but the nature of the barrier is determined by ...


4

Negative rings are false rings. They are not actual privilege levels of the CPU. The way rings work is simple. Some instructions have privilege checks where they verify that the current privilege level, or CPL, is sufficient and if it is not, the instruction fails with a general protection fault. CPL0 is ring 0, CPL1 is ring 1, etc. Some instructions will ...


4

Recent Intel CPUs have PCID. PCID helps a lot with the performance hit because without it, you have to completely separate the kernel TLB from the userspace TLB. (* Ok, not completely, but mostly). If you have PCID, then the hardware has an extra feature to avoid the performance penalty from the cache misses that would normally happen when you do that. To ...


2

I looked into the source code of the tool written by Alex Ionescu on his github page. In short: this tool checks if branch prediction is enabled for your processor or not. I haven't found a source yet, but it seems to me, that it is possible to disable branch prediction completely and therefore "mitigate" branch target injection. But this seems to be an ...


2

An answer that maybe requires less technical knowledge: Spectre was discovered in 2007. Spectre is a vulnerability that is based upon the instruction set architecture (ISA) of x86 processors. The architecture of processors has not changed too much in the last 20 years.[citation needed] It was theoretically possible to discover Spectre in ~2010, but for a ...


1

From page 7 of the research paper: While the leakage exists on all Intel Core processors starting from the first generation, the timing effect is higher for the more recent generations with a bigger store buffer size. The analyzed ARM and AMD processors do not show similar behaviour. Intel "Core" processors must refer to all modern Intel high-...


1

Their whitepaper says "The leakage can be exploited by a limited set of instructions, which is visible in all Intel generations starting from the 1 st generation of Intel Core processors, independent of the OS and also works from within virtual machines and sandboxed environments" In a table of results they show a Xeon CPU being vulnerable specifically ...


1

I will stay with the intel/x86 architecture for my answer, but it can probably be applied to other vendors/ring-designs. Ring -3 is 'the computer that runs your computer', the management engine on the mainboard. So the next logical step would be to look for a chip on the motherboard that could exercise total control over the system. The only thing I can ...


1

The issue with the SWAPGS instruction and its malicious use was that it was not known to be malicious. We've got to remember that we're talking about extremely complex systems and very few people know these structures in depth. Quite a few of these types of vulnerabilities has been discovered by private entities and not the chip manufacturers. This issue was ...


1

Since the content of the cache is gone once the system is switched off this kind of attack is only possible if you remove the disk while the system is kept running. In this case the attack should still be possible if it was possible with the disk still connected (i.e. probably not possible with up-to-date systems),


1

The reason your unpatched system appears not to be vulnerable to Spectre (and Meltdown) is that your processor is not affected¹ by the vulnerability. Your processor Intel(R) Celeron(R) CPU G530 is not on the list of affected products released by Intel [1]. The Spectre/Meltdown [2] website only states that "every Intel processor which implements out-of-order ...


1

First of all, Meltdown only affects Intel CPUs. It is a relatively simple exploit that affects all Intel CPUs with out of order execution, which is most everything since 1997 except for some Atom CPUs. Regarding Spectre, there is still a lot of confusion out there about what kinds of CPUs are affected by it. There's an article on tenfourfox about PowerPC ...


1

Today, I found a news from Molizza: Mozilla Confirms Web-Based Execution Vector for Meltdown and Spectre Attacks Mozilla has officially confirmed that the recently disclosed Meltdown and Spectre CPU flaws can be exploited via web content such as JavaScript files in order to extract information from users visiting a web page. This really bad. However ...


1

First row is guess (leaking by guessing), second timing (for this guess). So best guess, that syscall sysread is at 3a50, that matches reality.


Only top voted, non community-wiki answers of a minimum length are eligible