Slashdot Mirror
New Spectre 1.1 and Spectre 1.2 CPU Flaws Disclosed (bleepingcomputer.com)
Two security researchers have revealed details about two new Spectre-class vulnerabilities, which they've named Spectre 1.1 and Spectre 1.2. From a report: Just like all the previous Meltdown and Spectre CPU bugs variations, these two take advantage of the process of speculative execution -- a feature found in all modern CPUs that has the role of improving performance by computing operations in advance and later discarding unneeded data. According to researchers, a Spectre 1.1 attack uses speculative execution to deliver code that overflows CPU store cache buffers in order to write and run malicious code that retrieves data from previously-secured CPU memory sections. Spectre 1.1 is very similar to the Spectre variant 1 and 4, but the two researchers who discovered the bug say that "currently, no effective static analysis or compiler instrumentation is available to generically detect or mitigate Spectre 1.1." As for Spectre 1.2, researchers say this bug can be exploited to write to CPU memory sectors that are normally protected by read-only flags.
as safe as expected anymore. So many thought some designs would be. That their fav brand would be ok.
Lets create a software layer over the CPU to make it all safe. Get that fast speed way down.
Domestic spying is now "Benign Information Gathering"
The variants AMD are affected by are the low risk hard to exploit ones that are a long shot. The intel only one is more trivial to exploit.
Do you work for Intel? AMD is not vulnerable to the newly announced exploits. Also the ones AMD is vulnerable too are low risk and hard to exploit, far lower risk than Intel only ones, which are trivial to exploit. Bottom line: AMD is VASTLY safer.
We will see whether this holds up, but at the moment Intel is the one that played it fast and loose in order to have a few percent more performance, while AMD was far more careful and conservative and is now far less at risk and maybe not at all due to massively higher effort to exploit the subset of these vulnerabilities where they are affected. It is still possible that an easy to exploit variant will eventually be found for AMD too, but at the moment there is none.
Given that AMD has already done some additional things against this class of exploits in Zen 2, it may be that Intel CPUs will be a continued problem for the next years, while the same things may be more of an annoyance on AMD or not even present. Well, market dominance is never a good thing. Quality almost always suffers and prices get inflated. It would be a good thing if Intel got cut down quite a bit in size.
Of course, many people now have do defend their bad decision to not even have looked at AMD and they are intent to muddy the waters.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
It only has to be implemented once and copied. Re: Life.
Until viruses use it. Viruses were original POC.
Re: Javascript
And one based on Meltdown and/or Spectre could potentially bypass all security without any possible generic fix. So, obviously it'd be nice to know about it.
Yes, /rant. Who's going around burning their CPUs? The point is to find out as many of the vulnerabilities now to start introducing fixes in hardware. And knowing there are more varied variants means the fix needs to be more generic. It also means that we have to start honestly considering the possibility that javascript can be an attack vector against CPU bugs, so that's something to mitigate against where reasonable.
But, yea, let's not point out the potential scope of this or light an impetus to change CPUs to mitigate these risk! We should just not really cover it. Then if/when the attacks do come because people find out how to make them more doable, we're then really boned. I mean, it's not like it takes years for CPU designs to be developed and deployed to replace current CPUs.
3) This requires the virus to be running ON your fucking computer!! If you are running ANY virus on your computer, you're hosed.
You're not thinking about the countless virtual machines running on someone else's hardware (i.e. "The Cloud"). It's not "your" computer that must be compromised. It's the hypervisor that it's running on, or possibly someone else's VM running on the same hypervisor.
OK, show me a WORKING implementation where a guest OS can read anything useful out of a hypervisor's cache. Does anyone have ANY idea of how hard it must be to grab a (roughly) 16KB of cache data (presuming that it is 100% accurate, of which I am yet to be convinced) and determine exactly what that chunk represents?
I'm still calling Shenanigans on this vulnerability being useful in any real context, until/unless someone can demonstrate: reading cache data via this vulnerability and THEN knowing just WTF that data was!
Mitigation of prior SPECTRE attacks is cheaper on AMD than on intel. I would be surprised to learn that was not the case again. In addition, it's more difficult to exploit on AMD, and further, AMD was NOT vulnerable to all the classes of SPECTRE attack which affected intel processors. So while you're technically correct, there are also caveats.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
You have been doing things wrong, then. I have been using AMD processors literally since the K6, and that was literally the last processor to give me any kind of trouble. And the last K6 I owned was in a laptop and gave me literally zero trouble (although the garbage ATI rage pro lt sure did.) My current PC has an FX-8350 and a pair of Zotac GTX 950 AMP! cards in, and has literally been my most trouble-free hardware ever - and I've owned SGI, DEC, Sun, IBM, Apollo, Amiga, Macs... You name it.
The K6 that caused me problems had a VIA chipset. Yep, there's the problem, it says VIA on it.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
You failed, fundamentally, do answer my largest question: Presuming that you can read a blob of data from cache (which, yes, can be done...), show me how you make sense of that data?!?
Is it code? Is it data? How Da Hell do you know? I've heard Peter on Ars go on and on about how your passwords are leaked. Bullshit! Show me how (other than, say, running 'strings' or 'grep') on a small pile of cache data and make fucking sense out of it!
Regular viruses KNOW what they want and grab it. This is cache-tickling looking for a needle in a tremendously large haystack!
If I received a dump of memory from a process there's probably a lot I could work out just from a hexdump as well as running strings or grep. I've personally reverse engineered a few proprietary binary file formats by making small changes in an application, then staring at hex dumps of the saved files.
It's not a huge leap to do the same with the RAM of a target program. Run it in a debugger, make small changes and watch where those changes are written. Once you work out what to look for, then you automate the search in the virus.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
I too had stability issues with the K6... It turned out it was related to the VIA chipset, and more specifically the drivers.. Not that they were buggy, no no, they failed to handle buggy 3Dfx, buggy NVidia and buggy Soundblaster hardware that were all violating the PCI standard, and when you had two of them (which most gamers had), there were small but non-zero chance they would step on eachothers toes due to their abuse of the PCI standard and fuck the system state up.
The non-VIA drivers and Intel BIOS all had work-arounds to keep those buggy hardware in check. After the issue was fixed in a VIA-driver update, there were no more crashes.
But as often is the case. The blame lied nowhere close to whom most people blamed.
Same here, although I started with the K5.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
My AMD k6 was great!
I had trouble with my slot-A Athlon 750 back in the day.
I bought the cheapest, trash motherboard with the even more trash Via KX133 chipset on it. The KT133/KT266 went on to be a pretty much legendary value, but that KX133 was basically beta-quality. Should have spent the extra $20 on the AMD-750 chipset instead, but you live, you learn.
My next one was a socket A with a KT133A, ran like a top with a heavily overvolted/overclocked Duron, haven't had any trouble since (Athlon XP, Athlon64).
Got my eye on a Ryzen 2400G for my next machine. Well, for home.
For work, I'm looking at dual 24 core Epycs...