20 ms·
The mysterious case of the Linux Page Table Isolation patches
- tbrownaw 9y ago"Hey, I think I noticed a horrible horrible embargoed security bug. I know, I should do my best to pole holes in the embargo early!"
- aceofspad3s 9y agoMaybe they shouldn't have started merging the patches in the open if they weren't ready to disclose the bug.
- justincormack 9y agoIt has been obvious something is up for weeks now, and the disclosure is apparently going to be very soon, so it is a bit late to worry.
- syshum 9y agoAhh yes, Security through Obscurity that is always the best If no one talks about a security problem that makes it disappear
- preordained 9y agoIf you're taking off for vacation and forgot to lock your door, the best thing would be to go back and lock it. If you couldn't get the door locked right away for some reason, you probably wouldn't want the news of your unlocked door broadcast through your neighborhood... Obscurity actually is a layer of security. The mistake is is when people are dependent upon it.
- jstanley 9y agoBut this isn't one persons' door that's unlocked. This is more like a company that shipped a faulty door lock and is trying to keep it secret until they can ship fixed doors to everybody.
- syshum 9y agoYour analogy is severely flawed as my door lock is under my control and I know about the risks (i.e it is unlocked) so I can take the steps I need to mitigate that risk For your analogy to apply here it would be the manufacturer of the door lock having a master key stolen then not telling anyone about it until they have a new lock for you to buy from them, in the case of a lock I would want to know that the lock is useless even if there was not solution so I can mitigate the risk no simply continue locking it believing it to be secure
- neerajsi 9y agoLocksmiths can get into many locks that people use to secure their houses. That doesn't mean that I want them to share that knowledge widely.
- pixl97 9y agoEh, that information is shared widely. Some decent googl-fu will get you the information you want. The difference is a lock-pick can't exploit 20,000 doors in 20 minutes.
- syshum 9y agoI see so now we are advocating for the suppression of Speech... Because how else are you going to prevent that? Pretty sure there are 100's of youtube vidoes on lock picking, you want to ban all of them?
- 9y ago
- saas_co_de 9y agoEmbargos do not make you secure. If the bug exists the only safe assumption is that it is already being exploited. The faster the information gets out the better.
- avh02 9y agoNo, but they prevent everybody with ill-intent from exploiting the issue en-masse
- jstanley 9y agoNo they don't. They prevent everybody with ill intent who doesn't already know about it from finding out about it from the guys without ill intent. That's all.
- avh02 9y agowould you say it prevents the small fry from having a big impact? edit: I think the mirai botnet(s) had some sort of power struggle? avoiding propagating knowledge about it prevents it from being easily exploited by more actors.
- brazzledazzle 9y agoThe reality is that there's a group you're excluding from consideration and I don't think it's unreasonable to conclude that embargoes keeps every random "hacker" from taking advantage of it in a packaged form. Being vulnerable to the minority population that can and would take advantage of it vs. anyone that would is a valid consideration and shouldn't be dismissed so casually.
- saas_co_de 9y agoOnce there is disclosure then 100% of users can make the choice to take appropriate mitigation steps. Prior to disclosure there will always be the possibility that some users are being exploited without their knowledge. Therefore disclosure always improves the situation by giving those who could have been exploited without their knowledge the choice to take mitigation steps. All of the "responsible disclosure" nonsense is just PR by companies who want to avoid the most obvious mitigation, which is for customers to stop using their products.
- cjbprime 9y agoThey weren't really trying to uncover the exploit such that they can reproduce it. They were trying to learn who the exploit affects and what the impact is. I don't think there's anything wrong with that. If you're an AWS customer who depends on hypervisor isolation for critical security guarantees, it helps you to know that this is threatened and perhaps exploitable. Please don't buy into the idea that embargoes and coordinated disclosure are sacred. They tend to just reinforce existing power structures, sometimes in an unethical (or at least unfair) way.
- madez 9y agoThe CCC stated also that they observed that companies take a more reactive rather than proactive stance regarding their IT security because they believe that they will be notified of vulnerabilities prior of public disclosure or attacks. This may justify not following embargoes and coordinated disclosure.
- tbrownaw 9y agoDo you have a link? I'd expect the incentives to be a bit more complicated than that, and I'm also a bit skeptical that either is all that good of a solution. I'd also like to see how exactly "proactive" and "reactive" are being used here, is it about push vs pull for vulnerability notifications, or about hiring their own security researchers, or... ?
- tbrownaw 9y agoPlease don't buy into the idea that embargoes and coordinated disclosure are sacred. They tend to just reinforce existing power structures, sometimes in an unethical (or at least unfair) way. They're an attempt to minimize harm, by getting things patched while minimizing information leaked to blackhats. Just because giving preference to groups with a better reputation and more market share isn't "fair", doesn't mean it's automatically wrong. Now, if you can show that it actually doesn't help . . .
- cjbprime 9y agoI didn't say it was automatically wrong. I said it was sometimes wrong, and not sacred.
- caf 9y agoAnyone capable of exploiting this issue based on the information in that blog post, already knew everything in that blog post.
- joncrane 9y agoIf true, this is pretty huge. As if the AWS "You blew through your budget" emails right around midnight of New Years were only an appetizer. Edit: AWS Spurious Budget Email Barrage: https://www.reddit.com/r/aws/comments/7ndvli/anybody_get_spurious_aws_budgets_alarms_early_on/ https://www.reddit.com/r/aws/comments/7ndvli/anybody_get_spu...
- ProAm 9y agoI missed what happened with AWS? Any details
- SimonKinds 9y agoI'm assuming the person you replied to is referencing emails that AWS sent out on New Year's, stating incorrect forecasted usage. Some discussion can be found on reddit https://www.reddit.com/r/sysadmin/comments/7ndlk7/aws_anyone_get_any_bizarre_billing_alerts_with/ https://www.reddit.com/r/sysadmin/comments/7ndlk7/aws_anyone...
- jerrysievert 9y agonot sure on exact details, but I received one as well, on a free-tier account I had sitting around with an empty dynamodb table that was showing very high projected usage. it was enough that I logged in immediately thinking that account had been hacked. nope, still empty table, deleted it and went to bed. glad I wasn't the only one who got that.
- dghughes 9y agoSame here. Mine was on standby so I terminated it. I wasn't sure what was going on so I nuked everything cancelled my account and will hope for the best.
- dghughes 9y agoAmazon sent me an email this morning (Jan 3, 2018) to say I have a bill but I had already cancelled my free account. I can't see what I owe (hopefully zero dollars) because my account is now non-existent. One tiny Ubuntu instance I barely used and then put on standby. Then terminated. Ugh :(
- jbfoo 9y agoShouldn't cloud-grade computers be immune to rowhammer (or at least rowhammer should be much less efficient) as they typically use ECC RAM. Switching ECC RAM in a way that also modifies checksum in a deterministic way is (was?) not practical?
- thrill 9y agoThe bit flip would be done in a normal fashion - i.e. a command issued that changed the memory location, and hence updates the checksum. The occasional (about one bit flip per Terabyte per hour I think, on average) stray cosmic ray inducing a momentary over-voltage causing the checksum to now disagree would hopefully be within the design's ability to flip back.
- rocqua 9y agoThat's not how rowhammer works. It's a hardware level thing. Essentially, when you start rapidly flipping a single bit, that starts to 'leak' some current to the adjacent physical bits. This then allows you to flip a single bit. Especially if you can control bits on both sides of your target. It's like you are using the bits you can control to 'simulate' an actual stray cosmic ray.
- justincormack 9y agoYes one would thin so. And the mitigation patches in Linux suggest a CPU bug that could be fixed in future CPUs, not just rowhammer like attacks that are related to memory. So still think the attack path may be different.
- dmm 9y agoECC doesn't protect you from from all rowhammer problems because they can flip more than two bits at a time, the limit which ECC can detect. "Tests show that simple ECC solutions, providing single-error correction and double-error detection (SECDED) capabilities, are not able to correct or detect all observed disturbance errors because some of them include more than two flipped bits per memory word" https://en.wikipedia.org/wiki/Row_hammer#Mitigation https://en.wikipedia.org/wiki/Row_hammer#Mitigation
- revelation 9y agoNo ones hiding anything, this patchset was developed in the open for many many months. The hysteria and intrigue in this random tumblr blog is completely superfluous. It's a hardware bug anyway. Here is a good hint to when something is not being embargoed: there is a paper and a public demonstration.
- saas_co_de 9y agoIt sounds like Intel, Google and Amazon are hiding something. Wouldn't want customers thinking that cloud computing is fundamentally insecure now would we?
- revelation 9y agoWell Intel for one manufactures the insecure CPUs.. This will be merged for 4.16, when there is no 4.15 release yet. No idea what your cloud computing companies run but it's not 4.15-dirty, and backporting this monster is a great recipe for a nightly emergency when it goes OOPS. edit: it isn't even merged yet.
- justincormack 9y agoIt is being backported to 4.14, and presumably earlier kernel too.
- revelation 9y agoSure, with the appropriate baking time. But I don't see a cloud company taking an intermediate version of this patchset, backporting it themselves and then sending it out to all their customers in a hurry.
- tonfa 9y agoWhy not? Isn't that what they should do in case of a kernel security issue?
- 9y ago
- nobody987 9y agoAWS had scheduled maintenance requiring reboot of all EC2 instances in December. Maybe this is somehow related.
- chillydawg 9y agoIt wasn't all instances. Only one of mine needed a reboot.
- nobody987 9y agoIn my case the reboot was scheduled for most (if not all) EC2 and RDS instances.
- evfanknitram 9y agoAzure in the start of January.
- butz 9y agoSome EC2 instances will be rebooted this week, but notification was sent a few weeks ago - probably routine maintenance.
- thenickdude 9y agoI think it was just their paravirtual instances that have a scheduled reboot. I haven't heard that any of the newer HVM ones are affected.
- bluedonuts 9y agoWe had a large % of our longer running instances have scheduled reboots in Dec. Is it linked and if so does that mean AWS have already patched?
- rwmj 9y agoThis is probably a better link: https://lwn.net/SubscriberLink/741878/eb6c9d3913d7cb2b/ https://lwn.net/SubscriberLink/741878/eb6c9d3913d7cb2b/ (https://news.ycombinator.com/item?id=16001476 https://news.ycombinator.com/item?id=16001476)
- userbinator 9y agoIMHO, with RowHammer, the hardware is broken and it will continue to be broken until users complain enough --- maybe to the point of absolutely refusing to buy --- that the manufacturers and designers stop thinking "works 99.9999999999% of the time" is good enough: https://news.ycombinator.com/item?id=12410274 https://news.ycombinator.com/item?id=12410274
- avian 9y agoWhy would users refuse to buy hardware that works 99.9999999999% of the time when they apparently have no problem buying software that works 99% of the time? Radioactive decays and cosmic particles flipping bits give an upper bound for reliability. You are not going to see low-background packages and rad-hard chips in your iPhone.
- userbinator 9y agoRadioactive decays and cosmic particles flipping bits give an upper bound for reliability well below 99.9999999999% If it works 99.9999999999%, then it has a failure rate of 0.0000000001%, or 1E-12. Considering that a modern CPU executes approximately 1E9 operations per second, and that regular HDDs have a worse-case BER of 1 in 1E14 bits, 1E-12 is actually rather horrible and the actual error rate of computer hardware is much better than that. Imagine if a CPU calculated 1+1=3 every 1E12 instructions. At current clock rates, that's a fraction of an hour. Computers simply would not work if CPUs had such an error rate. I picked the 1E-12 number arbitrarily, but it's quite illustrative of the reliability computers are expected to have, despite their flaws.
- avian 9y agoI edited my reply to remove the actual number. The argument still stands that you cannot expect 100% reliability.
- monochromatic 9y agoA small probability of random errors can be lived with. Errors that can be triggered and exploited are unacceptable.
- qume 9y agoThe bare metal cloud providers will be rubbing their hands together
- cm2187 9y agoThough isn’t it only a problem when two VM share the same physical machine? If yes then all you need to do as a client is to never rent a fraction of a physical machines but specs that correspond to a full machine.
- JoshTriplett 9y ago> If yes then all you need to do as a client is to never rent a fraction of a physical machines but specs that correspond to a full machine. Cloud vendors don't guarantee colocation of your resources unless you specifically arrange that. And for that matter, often you specifically don't want co-location, because you want redundancy and migration.
- zymhan 9y agoThis affects more than just cloud providers though; that is just one of the more high-profile implications of this potential bug.
- saas_co_de 9y agoI never understand why people don't go bare metal. It is just as easy to automate, just as cheap (or cheaper) if you plan well, and more secure. A decade ago everyone knew that shared hosting was for hobby sites and stuff that didn't really matter. Maybe some more people will learn that lesson.
- daenney 9y agoI have to disagree. If you look purely at hardware cost of bare metal vs. what the same compute costs on cloud then sure, cloud is more expensive. > It is just as easy to automate [..] It's really not. As someone who's done provisioning automation at 2 companies, this is hard. Hardware is difficult, every new generation of hardware introduces new challenges in the provisioning and the more hardware configurations you need to support (and different vendors, all kinds of PCI plug-in cards etc), the more likely things go wrong. It takes a full team to build, maintain and debug this. It takes a couple of hours to build a GUI that calls the GCP API's to provision an instance for you, assuming you even need to do this instead of just using the Cloud Console directly. Sure, you pay for it, but now you have 4-10 engineers freed up to do something that provides actual value to your business. > [..] if you plan well [..] If. But that's really hard. Capacity planning and forecasting is complicated and the smaller a player you are, the harder it'll be for you to get a decent vendor contract with significant discounts and to be able to adjust and get to hardware quickly outside of your regularly forecasted buy-cycle. On the other hand, it's not your issue in the cloud. You request the resources and as long as you have the quotas, you'll get it (with rare exception). > [..] and more secure [..] I severly doubt that. In most cases, though you can host your stuff in certified DC's you'll still be in a colocation facility. Most cloud providers have their own buildings or rent complete buildings at a time. No one else but them has access to those grounds. Aside from that, take a look at what Google for example does on GCP to ensure that their code and only their code can boot systems, how they control, sign and verify every step of the boot process[0]. I've yet to see anyone do that and I doubt most companies that do bare metal have even thought of this or have the knowledge to even execute on this. [0]: https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-security-in-plaintext.html https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-... Aside from all of this, cloud isn't competing with just providing you compute. VM's (GCE, EC2) is just the onboarding ramp. The value is in all the other managed services they offer that you no longer need to build, maintain, scale and debug (global storage and caching primitives, really clever shit like Spanner or Amazon RDS/Aurora, massively scalable pub/sub and load balancing tiers, autoscaling, the ability to spawn your whole infrastructure or your service on a new continent to serve local customers in a matter of minutes etc). If all you're using cloud providers for is as a compute provisioning layer, then you're doing it wrong.
- john_moscow 9y ago>public NT kernels from as early as November have begun to implement the same technique. Does the author refer to ReactOS, or has Microsoft really open-sourced parts of the NT kernel?
- yjh0502 9y agoI seems that someone discovered KASLR from NT kernel. https://twitter.com/aionescu/status/930412525111296000 https://twitter.com/aionescu/status/930412525111296000
- neerajsi 9y agoReverse engineers pretty much know how everything in NT works. Msft publishes enough symbols that it's even possible to automatically decompile much of the code. Something like page table splitting would be obvious.
- bhouston 9y agoAnd the source of an older version of NT leaked a while back.
- nikanj 9y agoI think that was NT 4. I don’t think there’s much of that 20-year old code left in the kernel.
- ams6110 9y agoI'd actually be surprised if there weren't quite a bit of it still in the kernel.
- wasx 9y agoActually given the horror stories that have been told about the windows source code over the years, I'd be very, very surprised if there wasn't 20 year old code in a lot of places. Hell there's still 20 year old code running in the Linux kernel
- jaccarmac 9y agoThe kernels for Gentoo have been all over the place for the past few weeks. I'm running 4.12 at the moment, then the repos updated to 4.14, which wouldn't build for me, so I waited a week for genkernel to modernize. When I came back 4.14 had been marked unstable and 4.12 was masked, making 4.9 the latest supported kernel. Seems that whatever is happening is a Big Deal.
- revelation 9y agoThats because Gentoo decided to switch on a new compile flag, then didn't bother to test that the kernel still boots: https://lkml.org/lkml/2017/12/29/449 https://lkml.org/lkml/2017/12/29/449
- amluto 9y agoAnd, for reasons that are entirely unknown, the issue got worse due to one of the PTI patches (written by, and hence tentatively blamed on, yours truly). Presumably it caused some minor change in code generation causing GCC to go nuts. FWIW, the compile flag that Gentoo enabled activates a seriously busted GCC feature, and I'm a bit surprised that Gentoo gets away with it in user code.
- djsumdog 9y agoWhich compile flag is that? (I run Gentoo) Edit: nevermind. It's the -fstack-check flag mentioned in the other comments.
- caf 9y agoIs there anywhere to read up on the bustedness of the stack probing feature? (apart from the obvious incompatibility with trying to do that for kernel code).
- JdeBP 9y agoProbing more than a page size below the current stack pointer is wrong. Probing more than a page size further when one's saved frame area, save area, locals area, and (maximum) calling parameters area do not amount to a page in total is also wrong. For more on the considerations that underpin stack probing, see http://jdebp.eu./FGA/function-perilogues.html#StackProbes http://jdebp.eu./FGA/function-perilogues.html#StackProbes for starters.
- Asdfbla 9y agoJust curious: Even after an attacker goes through all the effort of finding out the physical address of the memory location they want to manipulate, how would someone make sure to get an adjacent memory location to even attempt to execute the Rowhammer attack? And even then, the smallest memory units allocated are basically pages within page frames, right? So if your target memory row is within a physical page frame, does the RowHammer attack even work? (Since there's no adjacent row an attacker has access to then.)
- IronBacon 9y agoOn Android there was a rowhammer POC used to gain root. Never looked at the details but it's in my TODO list... ^__^;
- seibelj 9y agoIf it’s something that can be triggered from browser JavaScript, maybe it can be attempted N times per second, and there is a mathematical probability of gaining full privileges within a set amount of attempts.
- twoodfin 9y agoI'm confused about the TLB impact. The pythonsweetness link claims these patches now require TLB flushes when crossing the kernel/user boundary, but the description of KAISER @ lwn[1] suggests that these flushes are unnecessary with "more recent" processors supporting PCIDs. How recent is "more recent", and is the PCID support likely to be ported back to earlier kernels along with KPTI? TLB flushes for syscalls would be absolutely brutal for many performance-critical applications. [1] https://lwn.net/Articles/738975/ https://lwn.net/Articles/738975/
- bonzini 9y agoPCID support is unlikely to be backported, but perhaps a simpler scheme with only two PCIDs (user and kernel) could be applied...
- kentonv 9y ago> PCID support is unlikely to be backported I dunno, it sounds like it might be easiest to go ahead and backport PCID along with these patches. It touches a lot of the same code, so trying to split it out might just create more problems.
- jabl 9y agoYes, and the impact on syscall-intensive workloads is bad enough with PCID, without it it's even worse. I'd be moderately surprised if only KPTI is backported and not PCID.
- jabl 9y agoAccording to https://www.realworldtech.com/westmere/ https://www.realworldtech.com/westmere/ , PCID's were introduced in the Westmere generation.
- pja 9y agoIf the problem is row-hammer style attacks on the TLB that let you map userspace writable pages into the kernel address space then any kernel entries remaining in the TLB when userspace is running are going to be a security hole. The problem won’t be a process writing to the kernel entry (that would be forbidden by existing code / hardware) but a process updating it’s own TLB entries in ways that corrupt adjacent kernel ones. PCID doesn't help you here - indeed it hurts, because it means there are more TLB entries from the hypervisor or other virtual machines remaining in the TLB to be corrupted! (Unless I have entirely the wrong end of the stick about this?)
- tambre 9y agoNon-AMP link: http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table http://pythonsweetness.tumblr.com/post/169166980422/the-myst...
- ce4 9y agoAlternatively, use Firefox (on your mobile) to skip Amp and other sillinesses. Greatly improved my mobile browsing experience, haven't looked back (ublock origin, hint hint).
- eat_veggies 9y agoFirefox is pretty slow on my phone and sometimes when I try to search something, nothing happens. I want to like it, but chrome is just a lot smoother :'( I do love how Google tries to "downgrade" its experience on Firefox mobile, but all it really does is cut out all the javascript and material design bullshit.
- dingo_bat 9y agoTry samsung browser if you have a galaxy device. It's smoother and faster than chrome and supports adblock extensions.
- vesinisa 9y agoWhen is the last time you tried Firefox on mobile? Since quantum landed on the Android version, it's become really smooth - comparable to Chrome on my phone (Pixel) at least.
- dang 9y agoOk we've changed to that above.
- aeleos 9y agoUsually I go into these things with a fair amount of skepticism but given the linux kernels usual pace of development and the nature of undisclosed bugs we have seen in the past this seems like a large hypervisor bug could be the reality. It must be pretty bad if its the kind of bug that they can't really fix easily, and have to push through an entire new feature into something as old and important as the paging code.
- vitaliyf 9y agoThis may or may not be related, but there is a Xen advisory embargoed until Thursday (see https://xenbits.xen.org/xsa/ https://xenbits.xen.org/xsa/) and I am aware of at least one VM provider who scheduled emergency VM reboots across their entire fleet this week because the issue cannot be addressed through hot-patching.
- snom380 9y agoI got around 10% of our Xen instances scheduled for reboot on Jan 4th, mostly long running instances. It's the first time I've seen that many instances scheduled at once.
- VectorLock 9y agoAlso got a large number of instances with scheduled reboot on Jan 4th in older AZs.
- Aissen 9y agoGuess: it is not directly related to RowHammer/DRAM, and is purely a CPU issue. Maybe PageFault timing info leaks or cache timing, like this pwnie award winner: http://www.cs.vu.nl/~giuffrida/papers/anc-ndss-2017.pdf http://www.cs.vu.nl/~giuffrida/papers/anc-ndss-2017.pdf If this last one can defeat ASLR, imagine leaking bit by bit from a co-hosted VM, to extract secrets of other cloud customers… This is the reason anyone serious about cloud security will reserve instances so that they won't share physical hardware with other customers (think EC2 dedicated instances).
- Aissen 9y agoAddendum: I know in most modern CPUs the memory controller is on-die, so my comment is partially wrong (RowHammer is definitely a SoC issue). Also, if you're interested in this type of things: Armv8.4-A adds a flag … indicating that you want the execution time of instructions to be independent of the data. https://twitter.com/agl__/status/927929410321244160 https://twitter.com/agl__/status/927929410321244160 Now the primary source seems to have been edited(why?)… But webarchive still has it: Data Independent Timing CPU implementations of the Arm Architecture do not have to make guarantees about the length of time instructions take to execute. In particular, the same instructions can take different lengths of time, dependent upon the values that need to be operated on. For example, performing the arithmetic operation ‘1 x 1’ may be quicker than ‘2546483 x 245303’, even though they are both the same instruction (multiply). This sensitivity to the data being processed can cause issues when developing cryptographic algorithms. Here, you want the routine to execute in the same amount of time no matter what you are processing – so that you don’t inadvertently leak information to an attacker. To help with this, Armv8.4-A adds a flag to the processor state, indicating that you want the execution time of instructions to be independent of the data operated on. This flag does not apply to every instruction (for example loads and stores may still take different amounts of time to execute, depending on the memory being accessed), but it will make development of secure cryptographic routines simpler. https://web.archive.org/web/20171107164628/https://community.arm.com/processors/b/blog/posts/introducing-2017s-extensions-to-the-arm-architecture https://web.archive.org/web/20171107164628/https://community... The scope seems limited to ALU, so not really related to the TLB thing we have here. Also, it's still very far away, I'm not sure its predecessor Armv8.3-A is even shipping to customers yet.
- lordmajster 9y agoIsn't this related to recent Linus rant about security patch from Google Pixel team? https://www.theregister.co.uk/2017/11/20/security_people_are_morons_says_linus_torvalds/ https://www.theregister.co.uk/2017/11/20/security_people_are...
- caf 9y agoNo.
- justincormack 9y agoLooks like it is speculative execution based, and does not affect AMD https://lkml.org/lkml/2017/12/27/2 https://lkml.org/lkml/2017/12/27/2 AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault. Disable page table isolation by default on AMD processors by not setting the X86_BUG_CPU_INSECURE feature, which controls whether X86_FEATURE_PTI is set.
- acoye 9y agoDo you think this could be within the rather new Intel AVX 512 ISA or older intel CPUs like Sandy Bridge (first AVX chip) could also suffer? - edit - I checked Ryzen ISA, they support AVX2. So probably AVX512 is the issue.
- rphlx 9y agoIt has nothing to do with AVX AFAICT. They are going to set X86_BUG_CPU_INSECURE [1] on all public Intel CPUs, including old ones that lack AVX (Core2, etc). [1] I do hope they rename that flag to something like X86_BUG_NEEDS_PTI as the current name is bloody abysmal: way too broad and ambiguous, as if this is the only insecurity that ever has or ever will impact x86.
- wilun 9y agoWell that very name hints that it is probably a very annoying bug, with an impact way more annoying that a simple ASLR address leak or data access trace (hell, Intel does not even consider side-channel data access / tlb tracing to SGX a vuln, so this has to be better than that kind of issues...)
- fulafel 9y agoEverything so far hints at a microarchitecture bug, not a ISA specific.
- 9y ago
- acoye 9y agoOk so all I hear is Intel and no trace of AMD? So X86_64 ISA wise the only diff between modern CPUs are AVX512. I bet you within the foundations of AVX512 lies a nasty one that can't be patched with microcode update.
- sd8dgf8ds8g8dsg 9y agoI'm confused, what makes you think the AMD and Intel cpu internals are the same?
- acoye 9y agoIt is not, but if like it was the case for rowhammer, it was linked to a specific instruction (clflush). This time it could be an AVX512 instruction (intel only) that leaks kernel address in a way or another. I was talking from an ISA perspective. For eg, clflush may be implemented differently between Intel and AMD, it has the same effect on system RAM hence a shared exploit.
- cesarb 9y ago> It is not, but if like it was the case for rowhammer, it was linked to a specific instruction (clflush). No, rowhammer does not need clflush. All rowhammer needs is to be able to write to the same physical memory locations repeatedly. Normally the cache would get in the way, so the attacker needs to bypass it. Flushing the cache (clflush) is one way, but there are others; AFAIK, it has been demonstrated rowhammer from within a Javascript VM, which has no access to clflush.
- acoye 9y agoYes, I knew you could do rowhammer on arm too where clflush does not exit. So rowhammer is not the correct example. Yet at some point it was believed that it was necessary on x86 for the attack to work. https://en.wikipedia.org/wiki/Row_hammer#Exploits https://en.wikipedia.org/wiki/Row_hammer#Exploits I just made a bet that I could guess something out of ISA only. Going macro to describe what may be the issue. I'm just doing a guess work here. I was not implying Intel has the same implementation as AMD, nor I was making a case for "this is like rowhammer"
- dingo_bat 9y agoEven though I understood less than 50% of that I am still very excited about reading more about whatever the real issue is. If somebody can pwn aws from a random instance that would be highly amusing to me :D
- phigcch 9y agoInteresting to note that https://en.wikipedia.org/wiki/Kernel_page-table_isolation https://en.wikipedia.org/wiki/Kernel_page-table_isolation was created on December 29th.
- TheSwordsman 9y agoOne question I have around this is whether the patches made to the Windows kernel in November exhibit the same performance hits. Does anyone know? I'm due to refresh my gaming PC, and I was going to go with Intel again as they've not been a problem. However, if Intel chips are going to incur the same 5% - 50% performance hit on Windows, I might end up investing in AMD hardware instead.
- JJJollyjim 9y agoI'm certainly no expert, but I would guess that the context-switch time (where I believe the new overhead is added) in games is fairly small compared to the raw number-crunching in-process, so the effect would be minimal in any case
- ifore 9y agoI would have thought that would have been a lot of context switching with graphics driver calls (Or maybe they already do as much as possible in userspace and then batch kernel calls?)
- snuxoll 9y agoEvery draw call will need to transition to kernel space to send data over the PCIe bus to the GPU. Modern games execute something on the order of 1000+ draws per frame, so assuming 60fps that's going to be at least 60,000*2 context switches into the kernel and back per second, more if you're doing high refresh rates. How big the impact I will be, I don't know - but I wouldn't be surprised if it was a couple percent (effectively ruining the single-threaded performance boost Intel has in gaming over AMD before accounting for overclocking).
- TheSwordsman 9y agoI was also worried about network I/O too, which could be an absolute pain for games where you care about latency.
- 9y ago
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- cybercognitio 9y agohttps://newsroom.intel.com/news/intel-responds-to-security-research-findings/ https://newsroom.intel.com/news/intel-responds-to-security-r...
- rasur 9y agoSo, I googled quickly but couldn't see anything obvious.. this does or doesn't affect Linux running on IBM Z Series mainframes then? I haven't seen much about if Power CPUs are affected by the same flaws
- hnaparst 9y agoWhere is the patch for the Linux kernel, and what kernel options have to be set? Also, are there any compilation options that need to be set?
- hnaparst 9y agoYou need to set CONFIG_PAGE_TABLE_ISOLATION=y in 4.11.11 or greater if you have an Intel CPU.
- taHAETY 9y agoThis might seem like a too easy theory, but if you l9ok 8nto the article posted by jedisct1 there is the somewhat unrestricted access of the L1 Cache and well with multiple mentions of Rowhammer, could it just be rowhammering from whatever the L1 Cache accesses?