Hot answers tagged

163

It's not even remotely true. Although you can use a Meltdown or Spectre attack to inspect the internals of a program in the way a debugger can, a proper debugger is much faster, easier, and more reliable.


119

This answer is an attempt at addressing simply the main concerns. The details here might not be exemplary accurate, or complete. I'll try to link to more detailed explanations when possible. What is speculative execution and what does it do? Speculative execution is a feature of modern processors that comes as an optimisation. To allow for the parallel ...


85

the only point of easy penetration to a system seems to be via javascript running in a web browser. How about Flash? Java? Silverlight? VBA in an office document? Any applications that load web-pages inside of themselves? The thing is, once a box has rogue code running, it's already compromised. With code running under your user account a lot can be ...


78

A normal debugger uses documented API/syscall/instruction to look at state of a process it is permitted to access. Just being a debugger alone cannot bypass OS memory protection, otherwise anyone who knows how to download stuff can gain admin access on any system. Meltdown and spectre attacks use (previously) undocumented and unintended side-effects of ...


45

First of all you would not normally expect kernel memory to be mapped in a GPU. Even if you did modern GPU's generally don't have much in the way of support for sharing memory between processes. There have certainly been research papers on speculative execution inside of a GPU - Speculative Execution on GPU: An Exploratory Study; Liu, Eisenbeis, Gaudiot - ...


33

The processors that were already announced and are about to be launched in the near future will still be vulnerable to both Spectre v2 and Meltdown if patches and/or firmware is not applied correctly. Spectre v1 was not entirely fixed with the latest patches. Most recent products have patches available, although not always functioning very well. You can ...


31

In my world, applying patches is a given. We're going to do it and it takes an exception to NOT apply a patch. Right now, those are exploits we know about for Spectre and Meltdown. However, what's to guarantee that there won't be more? Further, many exploits out there (such as Wannacry/Petya) involve systems that aren't patched for this known issue. I'd ...


22

I heard from a guy that's involved in low-level (assembler, C for drivers and OSes) programming, that meltdown and spectre weren't actually vulnerabilities discovered only so recently, but they were openly known as debug tools They may've gotten their wires crossed with another major vulnerability that was apparently recommended as a debugging tool about 1....


19

SharedArrayBuffer allows two threads to share state, so one can operate as a "clock" (incrementing the timing signal) and the other can read the "clock". Additionally, the availability of the Atomics object allows performing operations on the SharedArrayBuffer in a fashion that makes incrementing efficient and can be seen by the reading thread without the ...


18

A GPU (Graphical Processing Unit) is not vulnerable to spectre/meltdown attacks. This is due to various reasons: A GPU is a completely differently designed processor. It does not run privileged code (e.g. kernel code). It does not run the OS. It is optimized for Vector calculations. Its micro code is build completely differently. It (most often) does not ...


17

The core of the Spectre attack is to use mis-training of the CPU's branch predictor to cause the CPU to speculatively branch to an attacker-selected fragment of code while executing the target program, then observe indirect effects of running that code. This is only possible because current CPUs share branch-predictor state across all threads running on the ...


17

Nvidia has released updates today dealing with the issues. So I would assume there are risks since they have created updates. http://us.download.nvidia.com/Windows/390.65/390.65-win10-win8-win7-desktop-release-notes.pdf Table 2.1 Security Updates for NVIDIA Software Vulnerabilities CVE ID NVIDIA Issue Number Description CVE-2017-5753 1975134 Computer ...


16

My understanding, first off, is that the OS / hypervisor patch only mitigates Meltdown, not Spectre. Second, you patch the hypervisor to prevent a VM from reading memory belonging to the kernel of the hypervisor. You patch the guest OS to prevent a process from reading memory belonging to the kernel of the guest OS. My understanding is that they are ...


13

No, interpreted or JIT'd code is also vulnerable According to multiple sources, the attack can be exploited via JavaScript in browsers. An excerpt from the Windows Blogs on Microsoft: Today, Google Project Zero published details of a class of vulnerabilities which can be exploited by speculative execution side-channel attacks. These techniques can be ...


13

The performance impact will vary greatly depending on what the program does. After the Meltdown patch (KPTI) whenever there is a context switch from user-space to kernel-space there is a significant overhead because of the frequent flushing of the kernel page tables. So this means that a program that relies on frequent context switching (like a database ...


11

*Update: This article seems to cover everything. The attack papers share many of the same authors and use similar but previously unknown attack vectors. Both exploits resulted from the same (or at least inter-related) bodies of research. Both were initially reported on the same date (2017-02-01) - CVE-2017-5754, CVE-2017-5753, CVE-2017-5715 So assuming ...


11

The Wray paper is about categorisation of covert channels, and from a rapid reading, it does reference an attack on a cache by two processes explicitly loading memory locations, but to be used as a timing mechanism. The Sibert paper, in the section 3.10 merely identifies the covert channel, not the actual Meltdown flaw. In conclusion, although it can ...


9

Spectre. Intel SGX enclaves are indeed vulnerable to the Spectre attack as recently shown by researchers [1]. Their sample code manages to read a secret from protected SGX memory. Update Mar 7th, 2018. Meanhwile, another paper on the matter was published: SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution [2]. [1] https://github.com/lsds/...


9

They are both about equally terrible and still highly vulnerable to Spectre. Unfortunately, you would have to have access to confidential design documents in order to even begin answering this question. From (quasi-privileged) anecdotal evidence, AMD used to be really bad with setting lock bits (MMIO/MSR defaults, if I recall correctly), whereas Intel puts ...


8

I think you might be confusing the terms exploit and vulnerability. A vulnerability is a "hole" in the security, caused by a bug or poor implementation. They are detected by security researchers (white hat hackers), crackers (black hat hackers) or people in between (grey hat hackers). Those people are trying to break into the systems to either provide ...


8

Spectre is far harder to use than Meltdown. In a cloud hosting situation, an attacker needs to know: What software the target is using Where in memory that software is Where in memory the target data is The behavior of the host CPU's branch predictor The behavior of the host CPU's speculative execution system and possibly some other things I'm forgetting ...


8

Could Meltdown be exploited from C#/.Net (or other managed languages)? It can even be done from JavaScript.


8

Yes, because it can be used for privilege escalation. Usually, if an attack compromises a host, they only have user privileges. Using this vulnerability, they can escalate privileges by leaking credentials. Privilege escalation is important to attackers for carrying out many attacks, such as arp spoofing, SMB/LDAP relaying, token hijacking, credential ...


8

Install the patches unless you have a very strong reason not to. The approach you describe can basically be summed up as this: I know about exploit X. I could patch my OS to resolve exploit X, or I could carefully revisit every operation I do on my computer (including automated update tasks done for me). If none of those tasks provide a risk, then I do ...


7

Spectre works by causing the CPU to speculatively execute code selected by the attacker in the context of the target process. It does this by getting the branch predictor to guess incorrectly about which way an upcoming branch instruction will go, then looking for side effects of the code whose execution was discarded. Any CPU that performs speculative ...


7

If I understand you correctly you ask how the three issues shown by GZP map to the names Meltdown and Spectre. You'll find the answer at the beginning of this post from Google Zero Project: So far, there are three known variants of the issue: Variant 1: bounds check bypass (CVE-2017-5753) Variant 2: branch target injection (CVE-2017-5715) Variant 3:...


7

Any CPU that performs speculative execution is vulnerable to Spectre, so yes, 32-bit OSs are vulnerable. Meltdown is an issue with how Intel CPUs enforce memory protection while performing speculative execution (in short, memory protection isn't enforced until the point at which speculative execution is turned into real execution). 32-bit OSs on Intel CPUs ...


7

Simple tips In addition to M'vy's excellent answer, I just want answer this question: What can I do in order to be safe? Spectre, Meltdown and Rowhammer are CPU conceptual bugs, so they couldn't be correctly patched by a software update. This means: Actual software patches do mostly decrase the overall performance of any system (Windows, Linux of MacOS). ...


7

In general, no, for several reasons. First, Meltdown is an issue with how Intel chose to handle invalid memory accesses during speculative execution. A couple of ARM designs are vulnerable to a variant of Meltdown, but other than that, it's Intel-only. Second, Meltdown and Spectre both require that the CPU use a technique called "speculative execution". ...


7

It’s all speculation at this point. Normally, the 9th gen of Intel’s CPUs should be protected from the meltdown bug, and that generation is scheduled for the second half of 2018 (according to HKEPC). But that generation of CPUs was already quite ahead in development when the bug was found so it's quite likely that 9th gen will also be affected, in which case ...


Only top voted, non community-wiki answers of a minimum length are eligible