New Spectre 1.1 and Spectre 1.2 CPU Flaws Disclosed (bleepingcomputer.com) 109
Two security researchers have revealed details about two new Spectre-class vulnerabilities, which they've named Spectre 1.1 and Spectre 1.2. From a report: Just like all the previous Meltdown and Spectre CPU bugs variations, these two take advantage of the process of speculative execution -- a feature found in all modern CPUs that has the role of improving performance by computing operations in advance and later discarding unneeded data. According to researchers, a Spectre 1.1 attack uses speculative execution to deliver code that overflows CPU store cache buffers in order to write and run malicious code that retrieves data from previously-secured CPU memory sections. Spectre 1.1 is very similar to the Spectre variant 1 and 4, but the two researchers who discovered the bug say that "currently, no effective static analysis or compiler instrumentation is available to generically detect or mitigate Spectre 1.1." As for Spectre 1.2, researchers say this bug can be exploited to write to CPU memory sectors that are normally protected by read-only flags.
Not many CPU designs are (Score:5, Funny)
Lets create a software layer over the CPU to make it all safe. Get that fast speed way down.
Re: (Score:1, Informative)
IBM's Power Architecture is vastly more secure than X86 or amd64. Security has always been a priority for the Power Architecture since the beginning about 1985. Now Intel and x86 on the other didn't start implementing security features until about 2010. And lets not forget it was Hewlett-Packard engineers who tought Intel how to attempt to make and implement security features. Intel has always made shity insecure heaters. So you got extremely classified document well lets hope there on {Power or Sparc} beca
Re: (Score:3)
For example Power 8 CPUs are affected badly by Specter & Meltdown variants.
IBM put out a mandatory* update for firmware, microcode, PowerVM & AIX to fix this. Problem is that it introduces a huge slowdown in Java & Oracle DB workloads - We've seen things running up to 30% slower in our tests.
* = mandatory as in all future AIX updates have a dependency on those being installed.
Re: (Score:1)
a software layer like a VM can make things worse because it creates more "gadgets" that can be exploited, due to the way the flaws work. What they should have really done is simply had a switch in the CPU where the OS can turn off all of this speculative stuff, would have been simple to implement. *facepalm*
Re: (Score:3)
Got some experts ready for years of testing and hard work? Experts who can design an entire new way of thinking about a CPU and can think about past security flaws?
Make a CPU go faster is not going to be the only skill needed.
Re:Not many CPU designs are (Score:4, Interesting)
There have been mitigation being implemented for the bugs to reduce the severity of the problem, so that hopefully will keep current CPUs out of too much trouble. There are too many CPUs around of course to replace them all right away, so the software fixes have to suffice. Eventually new CPU generations will have more fixes built into the CPU. Many spectre variants are a long shot to exploit anyway.
From what I understand is that the flaws result from being able to tell what another process is doing through how fast some code runs. If another process is running the same code as your process, the behaviour of the other process can be gleaned by watching how fast code runs in your process. The CPU learns by watching code execute what code paths are most likely to be taken. So the learning from watching another process can affect other processes.
One solution for a CPU fix is to isolate processes so the CPU isolates its learning and predictions to within each process, one process will not affect the performance of other processes. Processes can not benefit from each other, thats the downside, but no more leaking of state between processes.
It could also be made so the Operating System can configure all of this in more detail about how much should be shared between process, if it all, what kind of optimizations should be done , or none at all, etc, so the user can make their own decisions about security/performance trade offs.
Perhaps the Operating System could be allowed to turn off hardware based optimizations and control the speculative execution scheduling itself which would make it easier to address bugs and security concerns with software updates.
It all requires some changes to the CPU, but from what I understand, its not all that of a big deal to add to CPUs.
Re: (Score:3)
Cross-process isolation can be somewhat simpler. The problem with Spectre specifically is that many programs (your browser opening /. for example) are within the same process running external -- interpreted -- code).
Re:Not many CPU designs are (Score:5, Informative)
ARM Cortex A8, 9, 12, 15, 17, 57, 72, 73, 75... all of those implement speculative execution are are all vulnerable to Spectre v1 and v2. Some also v3, v3a and v4
The A76 is only vulnerable to v1 and v4
https://developer.arm.com/supp... [arm.com]
IBM Power CPUs do speculative execution. IBM aren't fixing Power 6 and earlier.
Power 7, 8 and 9 have been patched apparently (requires both firmware and OS updates to mitigate)
I'm sure there's more.
Re:Not many CPU designs are (Score:4, Interesting)
Do you know anything about the cost of mitigation on POWER? We've known for a long time that those architectures were vulnerable, but I haven't heard anything about the performance impact of ibm's fix.
Re:Not many CPU designs are (Score:4, Informative)
We did tests on a Power 8 frame with real-life Java application and Oracle DB workloads.
- up to ~30% slower for Java
- up to ~15% slower for Oracle DB
It's ... bad ...
Re: (Score:2, Informative)
Power6 is very high frequency, but essentially in order. It does not speculate very far and is likely very hard to exploit. Power4 and 5 are really old now, although G5 are essentially a Power4 with Altivec.
Re: (Score:1)
There is one repeating pattern which is not architecture specific: all performance optimizations are based on avoiding redundancy, and that inevitably results in coupling between otherwise independent threads. So basically, you will always have to trade off security for high performance optimization, or limit optimization just within each separated world, where trust already exists among actors, but that means taking a utilization and performance hit. Intel is most vulnerable exactly because they had put to
Re:Not many CPU designs are (Score:5, Interesting)
Re: (Score:3)
The variants AMD are affected by are the low risk hard to exploit ones that are a long shot. The intel only one is more trivial to exploit.
Re:So (Score:5, Interesting)
We will see whether this holds up, but at the moment Intel is the one that played it fast and loose in order to have a few percent more performance, while AMD was far more careful and conservative and is now far less at risk and maybe not at all due to massively higher effort to exploit the subset of these vulnerabilities where they are affected. It is still possible that an easy to exploit variant will eventually be found for AMD too, but at the moment there is none.
Given that AMD has already done some additional things against this class of exploits in Zen 2, it may be that Intel CPUs will be a continued problem for the next years, while the same things may be more of an annoyance on AMD or not even present. Well, market dominance is never a good thing. Quality almost always suffers and prices get inflated. It would be a good thing if Intel got cut down quite a bit in size.
Of course, many people now have do defend their bad decision to not even have looked at AMD and they are intent to muddy the waters.
Re: (Score:2)
Does it matter? Their product is superior in a critical aspect.
Re: (Score:3, Informative)
You have been doing things wrong, then. I have been using AMD processors literally since the K6, and that was literally the last processor to give me any kind of trouble. And the last K6 I owned was in a laptop and gave me literally zero trouble (although the garbage ATI rage pro lt sure did.) My current PC has an FX-8350 and a pair of Zotac GTX 950 AMP! cards in, and has literally been my most trouble-free hardware ever - and I've owned SGI, DEC, Sun, IBM, Apollo, Amiga, Macs... You name it.
The K6 that cau
Re:For some of us it was not a bad decision (Score:4, Interesting)
I too had stability issues with the K6... It turned out it was related to the VIA chipset, and more specifically the drivers.. Not that they were buggy, no no, they failed to handle buggy 3Dfx, buggy NVidia and buggy Soundblaster hardware that were all violating the PCI standard, and when you had two of them (which most gamers had), there were small but non-zero chance they would step on eachothers toes due to their abuse of the PCI standard and fuck the system state up.
The non-VIA drivers and Intel BIOS all had work-arounds to keep those buggy hardware in check. After the issue was fixed in a VIA-driver update, there were no more crashes.
But as often is the case. The blame lied nowhere close to whom most people blamed.
Re: (Score:3)
Same here, although I started with the K5.
Hrm (Score:2)
30% Informative
40% Flamebait
30% Interesting
So the question is, did I get modded down by employees of Intel for saying nice things about AMD, by employees of AMD for saying mean things about ATI, or employees of VIA? No, wait, couldn't be that last one, their computer would have crashed before they got there.
Re: (Score:3)
My AMD k6 was great!
I had trouble with my slot-A Athlon 750 back in the day.
I bought the cheapest, trash motherboard with the even more trash Via KX133 chipset on it. The KT133/KT266 went on to be a pretty much legendary value, but that KX133 was basically beta-quality. Should have spent the extra $20 on the AMD-750 chipset instead, but you live, you learn.
My next one was a socket A with a KT133A, ran like a top with a heavily overvolted/overclocked Duron, haven't had any trouble since (Athlon XP, Athlon64)
Re: (Score:2)
Re: (Score:1)
2. Get them to focus on security this time, not just how fast.
3. Set up production line.
4. Sell a well designed CPU thats safe and fast.
Re: (Score:2)
It doesn't matter how good the engineer designing the CPU is. They are given the specs for the CPU. During the design they have to make choices to achieve the requirements and any choices that they feel uncomfortable about will be sent up to management to be signed off on. You can be certain that any design choices that trade speed for security in order to make the requirements will have had management made aware and sign off. Upper management at Intel, in this case but at all chip designing companies, have
Re:Advanced Micro Devices IMMUNE (Score:5, Insightful)
Do you work for Intel? AMD is not vulnerable to the newly announced exploits. Also the ones AMD is vulnerable too are low risk and hard to exploit, far lower risk than Intel only ones, which are trivial to exploit. Bottom line: AMD is VASTLY safer.
Re: (Score:2)
Do you work for Intel? AMD is not vulnerable to the newly announced exploits. Also the ones AMD is vulnerable too are low risk and hard to exploit, far lower risk than Intel only ones, which are trivial to exploit. Bottom line: AMD is VASTLY safer.
AMD has already admitted to being vulnerable to certain variants. Intel has mitigations for the most serious variants in place. The latest round of vulnerabilities have been mitigated through OS fixes. As long as you've been consuming these updates, there is no reason to think that Intel or AMD are in any different position at this point. AMD's pipeline definitely prevented meltdown from affecting them, and most likely makes it easier for them to provide future resiliency through silicon, but I don't see
Re:Advanced Micro Devices IMMUNE (Score:5, Informative)
Mitigation of prior SPECTRE attacks is cheaper on AMD than on intel. I would be surprised to learn that was not the case again. In addition, it's more difficult to exploit on AMD, and further, AMD was NOT vulnerable to all the classes of SPECTRE attack which affected intel processors. So while you're technically correct, there are also caveats.
Re: (Score:2)
Re: (Score:2)
Mitigation of prior SPECTRE attacks is cheaper on AMD than on intel. I would be surprised to learn that was not the case again. In addition, it's more difficult to exploit on AMD, and further, AMD was NOT vulnerable to all the classes of SPECTRE attack which affected intel processors. So while you're technically correct, there are also caveats.
Based on metrics I’ve seen from Intel, as well as tests performed by my own company, I do not believe that Intel is running any slower than AMD with these mitigations in place. And Intel has given us microcode updates for these fixes long before AMD provided any microcode fixes for their platforms. AMD and Intel have been notified of these issues at the same time. Intel has consistently provided us with fixes prior to the publication of these vulnerabilities and AMD has averaged a 2-3 month delay a
Re: (Score:2)
And Intel has given us microcode updates for these fixes long before AMD provided any microcode fixes for their platforms.
Many of those microcode fixes were garbage, leading to boot loops, boot hang... Intel does not deserve a reward for pushing out garbage to customers.
AMD and Intel have been notified of these issues at the same time. Intel has consistently provided us with fixes prior to the publication of these vulnerabilities
That is completely false. Intel lagged behind the initial announcement, then started pushing out buggy fixes.
AMD is definitely better protected against this type of attack but Intel has been far more responsive to all hardware or firmware vulnerabilities that Iâ(TM)ve seen that affect both platforms.
AMD did the right thing in the first place, so they are less affected by AFAICT all variants. They can afford to take a couple more days to get it right. They can't afford to push out buggy firmware fixes like Intel can, since they don't have the massive
Re: (Score:2)
And Intel has given us microcode updates for these fixes long before AMD provided any microcode fixes for their platforms.
Many of those microcode fixes were garbage, leading to boot loops, boot hang... Intel does not deserve a reward for pushing out garbage to customers.
They did rollback their Spectre V2 mitigation because it caused problems for some users and an OS mitigation was sufficient.
AMD and Intel have been notified of these issues at the same time. Intel has consistently provided us with fixes prior to the publication of these vulnerabilities
That is completely false. Intel lagged behind the initial announcement, then started pushing out buggy fixes.
I know for a fact that is not true because I receive access to both NDA advisories and NDA microcode updates. Intel did not release a production version of certain server platforms at the time of release because they do several months of testing server microcode before calling it production but the client microcode updates were all tested for at least a month and were made available
Quick - Panic! (Score:2, Insightful)
In the realm of software vulnerabilities, these are:
1) Ridiculously difficult to implement. At the end of the day, you are fundamentally tickling the cache and timing the resultant reads to try to determine the content of that cache. Is there ANY reasonable way to "read" the contents of said cache and determine what context a blob of data means?!?
2)Beyond trial code that is ALL based on the original POC distributed by virus vendors, etc. there is NO known implementa
Re:Quick - Panic! (Score:5, Insightful)
It only has to be implemented once and copied. Re: Life.
Until viruses use it. Viruses were original POC.
Re: Javascript
And one based on Meltdown and/or Spectre could potentially bypass all security without any possible generic fix. So, obviously it'd be nice to know about it.
Yes, /rant. Who's going around burning their CPUs? The point is to find out as many of the vulnerabilities now to start introducing fixes in hardware. And knowing there are more varied variants means the fix needs to be more generic. It also means that we have to start honestly considering the possibility that javascript can be an attack vector against CPU bugs, so that's something to mitigate against where reasonable.
But, yea, let's not point out the potential scope of this or light an impetus to change CPUs to mitigate these risk! We should just not really cover it. Then if/when the attacks do come because people find out how to make them more doable, we're then really boned. I mean, it's not like it takes years for CPU designs to be developed and deployed to replace current CPUs.
Re: (Score:1)
Re: Javascript
Not just Javascript.... Think Docker, VMware, Azure, AWS....
Anything running "untrusted" code.
Re: (Score:1)
There's a very simple solution to this: use microcode to add ring0 instruction that disables the cache. Then let the OS expose a way to mark a process as trusted. Any process not explicitly flagged as trusted gets to run without cache, and on top of that, even if the browsers were marked trusted, they'd all still fork themselves and run their JS in un-trusted child processes.
Re: (Score:2)
It only has to be implemented once and copied. Re: Life.
Actually no it doesn't. This isn't exploiting specific software, it's exploiting the CPU to read specific registers. The exploits are specific to both timing and system configuration at runtime and you have to have an incredible amount of access to a machine to make a meaningful exploit (reads: maybe you're running a VM owned on someone else's metal, or you've already 0wned the machine).
Until viruses use it.
Translation: Everything is safe until it's not. Analysis: An incredibly dumb arguement.
Re: Javascript
See 1. There's no generic fly-by im
Re: (Score:3)
3) This requires the virus to be running ON your fucking computer!! If you are running ANY virus on your computer, you're hosed.
You're not thinking about the countless virtual machines running on someone else's hardware (i.e. "The Cloud"). It's not "your" computer that must be compromised. It's the hypervisor that it's running on, or possibly someone else's VM running on the same hypervisor.
Re: (Score:3)
I'm still calling Shenanigans on this vulnerability being useful in any real context, until/unless someone can demonstrate: reading cache data via this vulnerability and THEN knowing just WTF th
Re: (Score:2)
Re: (Score:2)
Ridiculously difficult to implement.
Once.
At the end of the day, you are fundamentally tickling the cache and timing the resultant reads to try to determine the content of that cache.
Correct.
Is there ANY reasonable way to "read" the contents of said cache and determine what context a blob of data means?!?
By using the value you read to trigger another read somewhere else and tickle even more cache timing. You want to trick the CPU into doing something like;
var x = big_array[ (*pointer_to_sensitive_byte) * cache_block_size ];
Then you measure the cache timing of each block of your big_array. And repeat the process for every pointer you want to read.
Beyond trial code that is ALL based on the original POC distributed by virus vendors, etc. there is NO known implementation in the wild.
The original Spectre / Meltdown flaws were separately discovered by multiple researchers at the same time. Do you still feel safe?
This requires the virus to be running ON your fucking computer!! If you are running ANY virus on your computer, you're hosed.
Javascript, Cloud V
Re: (Score:3)
Is it code? Is it data? How Da Hell do you know? I've heard Peter on Ars go on and on about how your passwords are leaked. Bullshit! Show me how (other than, say, running 'strings' or 'grep') on a small pile of cache data and make fucking sense out of it!
Regular viruses KNOW what they want and grab it. This is cache-tickli
Re:Quick - Panic! (Score:4, Insightful)
If I received a dump of memory from a process there's probably a lot I could work out just from a hexdump as well as running strings or grep. I've personally reverse engineered a few proprietary binary file formats by making small changes in an application, then staring at hex dumps of the saved files.
It's not a huge leap to do the same with the RAM of a target program. Run it in a debugger, make small changes and watch where those changes are written. Once you work out what to look for, then you automate the search in the virus.
Re: (Score:2)
The Meltdown demos (from the original researcher) was able to read secure passwords stored in the OS that were supposed to be secured. This wasn't some elaborate setup. This was the guy (the researcher's) personal computer that he just happened to run the code on.
Re: (Score:2)
If you want to see how far exploiters will go to take advantage of these things, check out heap spraying [wikipedia.org]. It took a few years to invent heap spraying, but now it's considered a basic technique. We don't see exploits in the wild yet because it's still new, but soon we will.
Re: (Score:2)
If you use a browser and visit websites you are running random code you didn't purchase and probably have no idea what it does. The average website these days executes around 30 scripts from at least 8 different sources but possibly as many as 20 different sources. I've seen websites that had as many as 50 scripts running from upwards of 20 different sources.
There's a reason people use NoScript in Firefox, all those scripts are potential exploits. Even running in a sandbox they are capable of exploiting Sp
Re: (Score:2)
1) Ridiculously difficult to implement. At the end of the day, you are fundamentally tickling the cache and timing the resultant reads to try to determine the content of that cache. Is there ANY reasonable way to "read" the contents of said cache and determine what context a blob of data means?!?
Not that difficult. It just takes a long time as you're relying on certain processor timings. And you also have to target it to the specific microarchitecture you want to attack. So in that respect, it's difficult i
meh (Score:1)
These flaws are confined to test cases and proofs of concept. I'm going to wait for Spectre 2.0 (or 2.1, for the bugfixes)
Solution to ALL such problems: Physical Isolation (Score:1)
Hardware is getting quite cheap. How about running sensitive code and untrusted code on separate pieces of silicon? (memory and processor at least) -- Let the untrusted code run fast and efficient on one component (depending on the setup, it could even reasonably be native code), and the secure or sensitive code run on a separate component which is secured against as many side-channel attacks as is practical.
some architecture not on list (Score:2)
Don't see Ultrasparc on list of vulnerable CPU. Of course, I don't see it in any of the three locations of systems I admin either though 8D
Re: (Score:2)
I thought everyone had got rid of all their SPARCs by now? The sun machines are now antiques, and anyone who gives ORACLE money deserves the fornicating they're getting.
Re: (Score:2)
It's probably not listed because it's unknown because no one bothered to look due to the size of the market.
Re: (Score:2)
It seems that Oracle fired ALL the Sparc CPU engineers.
The Sparc CPUs might as well be vulnerable as Oracle has not released ANY statement since the beginning of the Specter/Meltdown fiasco to say whether their CPUs are vulnerable or not.
Think of the children (Score:2)
Re: (Score:2)
Meltdown is a specific attack, none of these new ones are Meltdown. Spectre is an entire class of attacks and it's going to have a ton of variants. There was a report about a month in a German magazine that they've already numbered Spectre out to 11 variants and counting that will eventually be divulged.
There were broad warnings when Spectre was revealed that this would be the exploit that would keep on giving because it used a new line of attack that's been known about for years but was finally shown with
watch Spcetre (Score:1)
This hits SPECIFICALLY INTEL cpus (Score:1)
This hits SPECIFICALLY INTEL CPUs [techpowerup.com] yet is presented as "AMD too".
Re: (Score:2)
There's no proof this new vulnerability can be exploited on AMD, but you'd be an idiot to claim AMD is immune to this one. It's been vulnerable to all the other variants so far detected, as has ARM.
That is a lie. AMD is not vulnerable to all the other classes of SPECTRE exploit, nor are their CPUs vulnerable to MELTDOWN.
Further, mitigation is cheaper (nearly free) in the cases where AMD is vulnerable.