12 ms·

Meltdown and Spectre

347 points by dustinmoris 9y ago

weinzierl 9y ago
Besides the LWN article Notes from the Intelpocalypse [1] this is the best high level overview I've seen for now. Here is are a few quotes (emphasis mine): Am I affected by the bug? Most certainly, yes. Can I detect if someone has exploited Meltdown or Spectre against me? Probably not. The exploitation does not leave any traces in traditional log files. What can be leaked? If your system is affected, our proof-of-concept exploit can read the memory content of your computer. This may include passwords and sensitive data stored on the system. Which systems are affected by Meltdown? Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown. Which systems are affected by Spectre? Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors. Which cloud providers are affected by Meltdown? Cloud providers which use Intel CPUs and Xen PV as virtualization without having patches applied. Furthermore, cloud providers without real hardware virtualization, relying on containers that share one kernel, such as Docker, LXC, or OpenVZ are affected. Why is it called Meltdown? The bug basically melts security boundaries which are normally enforced by the hardware. Why is it called Spectre? The name is based on the root cause, speculative execution. As it is not easy to fix, it will haunt us for quite some time. [1] https://lwn.net/SubscriberLink/742702/e23889188fce9f7f/ https://lwn.net/SubscriberLink/742702/e23889188fce9f7f/
- protomyth 9y ago
  I wonder if any of the companies the build their own ARM cores are not vulnerable?
- arca_vorago 9y ago
  I don't see user-mode linux, QEMU, or KVM on that list, or am I mistaken an they are affected as well(so maybe some amd users are safe?). Another reason I advocate every spinup should have FDE by default with a ssh key entry shimmy at initram, or is this runtime cpu acccess so it gets anything live? If so that's scary.
dimillian 9y ago
How would one exploit a Google Cloud physical machine for example? One would still need to inject/patch a file to exploit processor right?
- DevNullDevice 9y ago
  Meltdown doesn't _directly_ allow modification of code. However, a guest VM could run userspace code that accesses ring 0 / kernel memory of the hypervisor / physical machine. This would mean that security certificates, passwords, etc of the hypervisor could be exposed, which could then allow compromise.
  - levi_n 9y ago
    I would also assume this means exploits on a machine provisioned with multiple VMs from different customers would allow a malicious customer to leak data from another customer's VM located on the same machine.
deadmetheny 9y ago
As an aside, I wish that anyone who is responsible for the creation of a cutesy logo for a software vulnerability were able to be punished by having said logo tattooed on their forehead and given a giant nuclear wedgie for being such an insufferable dweeb.
- eej71 9y ago
  There is value in being able to package up the issue into something that is understandable and presentable to a larger non-technical audience. If a "cutesy logo" increases interest and engagement from a larger non-technical community, I'll take it.
  - JorgeGT 9y ago
    Research has concluded that naming storms/hurricanes results in a much better public response. People is more likely to take preventive action against "Storm Eleanor", rather that against an unnamed bad weather report, plus a name allows people to differentiate simultaneous events. In the same way, it is not far fetched to think that a name and logo are much more likely to convince users to quickly apply patches etc. than just CVE-2017-5753, CVE-2017-5715 & CVE-2017-5754. Plus, they are way easier to remember!
    - eej71 9y ago
      Very much agree. The other benefit that I see from the branding is that it serves as a bulwark against the (mis)information that will appear from those who might have a vested interest to downplay it (eg: intel).
- swarnie_ 9y ago
  "Can I use the logo? Both the Meltdown and Spectre logo are free to use, rights waived via CC0. Logos are designed by Natascha Eibl." I'm sure she would love to hear your opinion personally. Site - https://vividfox.me/ https://vividfox.me/ Email - mail@vividfox.me
- sctb 9y ago
djaychela 9y ago
Pleased to see a growing set of links at the bottom for the relevant information for different OSes, etc... However, somewhat surprised that Ubuntu isn't present - done a fair bit of searching today and have only found that the patches are in progress, which I'm a bit surprised about given the disclosure timeline that appears to be in place, and that SuSE and Red Hat seem to have patches in place and ready to go? * EDIT * - since posting this, there is now an Ubuntu link present, and an explanation that they were expecting disclosure on Jan 9th.
- brightball 9y ago
  That is a little surprising. Definitely making me re-evaluate my choice of local Linux.
  - deleted 9y ago
    [deleted]
  - RainaRelanah 9y ago
    This was supposed to release on January 9th, but Google pulled the trigger earlier due to community members putting the pieces together and starting to draw press attention. It isn't very fair to blame Ubuntu for being behind.
    - brightball 9y ago
      It’s not just that. I’ve been experimenting with different distros a lot this year (Fedora, Mint and Ubuntu for committed stretches) and Fedora is the only one where the machine didn’t regularly hang for some reason after a few days. Was happening multiple times a day with Ubuntu and currently much less often with Mint. Never happened at all with Fedora though. Between that at Redhats promptness on this it’s just giving me more confidence in that side of the house.
- yunyu 9y ago
  The linked entry states: The original coordinated disclosure date was planned for January 9 and we have been driving toward that date to release fixes. Due to the early disclosure, we are trying to accelerate the release, but we don't yet have an earlier ETA when the updates will be released. We will release Ubuntu Security Notices when the updates are available.
ashleyn 9y ago
It's not everyday that a security issue is borne out of a side-effect of underlying theory; in this case, how out-of-order execution works. It's almost as bad as if someone proved P = NP, rendering all cryptography useless on the spot. The game is changed forever, and CPU designers across the industry will likely have to can some or all of OoOE, setting performance back considerably. It can take years to reachieve performance we're used to today at the security level required.
- zitterbewegung 9y ago
  Bare metal servers that run trusted code like a build not are not effected. Maybe this will be a bios setting or a kernel flag to set .
  - swsieber 9y ago
    Kernel flag at compile time? - Yes Kernel flag at boot time? - No (the fix is a to compile instructions differently). Bare metal servers that only run trusted code are only unaffected so long as they explicitly opt out of the new security model, and I'm not sure how easy that'll be...
    - FreedomWarrior 9y ago
      IIUC it's not possible to opt out at this time (short of reverting the patches). Linus expressed some concern about it: https://lkml.org/lkml/2018/1/3/797 https://lkml.org/lkml/2018/1/3/797
      - slowmovintarget 9y ago
        What a tl;dr! Please talk to management. Because I really see exactly two possibibilities: - Intel never intends to fix anything OR - these workarounds should have a way to disable them. Which of the two is it?
    - blattimwind 9y ago
      I feel like user-facing server-side scripting languages should be investigated whether they incur the same risk as running JavaScript in a browser (which is big and complicated). I'm thinking about stuff like Sievescript and IFTTT-like applications.
hackermailman 9y ago
The paper on this site is well written explaining the method of using ROP with branch mispredict to load gadgets. Anybody interested in this, ROP, caches and branch prediction/misprediction is all in the intro [1]book[2]course CSApp [1]http://csapp.cs.cmu.edu/3e/labs.html http://csapp.cs.cmu.edu/3e/labs.html [2]http://www.cs.cmu.edu/~213/schedule.html http://www.cs.cmu.edu/~213/schedule.html (Youtube lectures)
neom 9y ago
I understand this "isn't the point" etc - for curiosity sake: How practical are these exploits? From my reading, it seems using them in an attack against a sophisticated target is incredibly difficult, and against an unsophisticated target is still probably prohibitively difficult? I'm not an engineer so please pardon the ignorance.
- NoGravitas 9y ago
  It looked like one of the proofs of concept was using javascript code to escape the sandbox and read memory from the browser's address space. So that seems to be quite a realistic attack vector, right?
- ashleyn 9y ago
  Depends on the browser. Chrome has mitigations, but not solutions to this, which largely consist of degrading the quality of the timer required to pull off Spectre. WebWorkers give you a more accurate timing method that can pull it off. Basically, any website can now theoretically read your encryption key in RAM and something like noscript will be required, not optional for maximum safety.
- pjc50 9y ago
  A nice little gif from twitter: https://twitter.com/misc0110/status/948706387491786752 https://twitter.com/misc0110/status/948706387491786752 User typing into a "secure" Linux (edit: was MacOS - can we do strikethrough here?) password dialog while another process steals the data. The first attack was incredibly difficult, but once there's a proof of concept, copies will proliferate.
  - fzzzy 9y ago
    That looks like linux, not mac os. But still.
  - arianvanp 9y ago
    That's Gnome, not MacOS ;)
  - williamstein 9y ago
chinathrow 9y ago
From the Ubuntu wiki, it's clear that someone broke the coordinated release date of January 9th. Does any one have more insights on why the news broke to soon? https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...
- mindcrime 9y ago
  IIRC, the Google Project Zero folks went ahead with the announcement early, because what had already leaked / been speculated, was so close to the truth. Apparently a bunch of smart people were paying attention to a recent set of kernel patches, and starting putting "two and two together" relatively quickly, based on the contents of the patches.
- Ajedi32 9y ago
  From what I recall, patches started showing up in the Linux Kernel, causing lots of buzz and speculation among the security community. People noticed that one patch was only being applied to Intel processors, leading some tech blogs to speculate that only Intel processors were affected by the bug, and that triggered a PR response from Intel. Then someone reverse-engineered an exploit and posted about it on Twitter, and the cat was out of the bag at that point, so they moved up the disclosure timeline.
  - baq 9y ago
    And it's a good thing they did that because a motivated black hat with the correct skill set most likely did, too. Not to mention nation state cyber ops.
sveme 9y ago
If I understand it correctly (not entirely sure), an adversary needs to have code running on a system to exploit either attack - would Javascript running in a browser be in principle sufficient to be able to exploit this, or are there some mitigations (sandboxes?) in place to prevent this from happening? Edit: Okay, found this post from yesterday: https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ https://blog.mozilla.org/security/2018/01/03/mitigations-lan... Thanks for the reply!
- derekp7 9y ago
  Yes, and one of the mitigations is to reduce the precision / accuracy of certain timer calls in Javascript.
- ckuehl 9y ago
  From the Spectre paper: > As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). https://spectreattack.com/spectre.pdf https://spectreattack.com/spectre.pdf
- paulhodge 9y ago
  Yes javascript is sufficient. I think Spectre is theoretically possible with just untrusted data (not just untrusted code). It would need an existing trusted program that has a branch-predicting loop like the one in the paper. The attacker would feed untrusted data into the loop and then observe secrets through cache timing. It's weird code, so it's probably unlikely an existing program would have it, but it's not outside the realm of possibility. The attacker would also need a high-precision way to measure the timing of the operation, which also might be hard to find in an existing program, but not impossible. Just something else to keep you awake at night!
  - kllrnohj 9y ago
    They need code execution to observe that cache timing, though, and they need to prime the branch predictor and cache.
danso 9y ago
Mostly OT, but is there an explanation for why the "Meltdown" vulnerability was named specifically as such, I mean besides the term's meaning when it comes to "melting" security barriers? Coincidentally, "meltdown" is currently a very popular term to describe reactions/revelations re: a soon-to-be-released politics book titled "Fire and Fury" [0]. I guess yet another example of "Naming things" being one of the hard problems. [0] https://www.publishersweekly.com/pw/by-topic/industry-news/publisher-news/article/75734-pre-orders-for-wolff-s-trump-book-skyrocket-as-trump-has-twitter-meltdown.html https://www.publishersweekly.com/pw/by-topic/industry-news/p...
- netman21 9y ago
  The term is ominous because it is the common description of what happens when the core of a nuclear reactor overheats and melts. The theoretical result is a molten puddle of fissioning material that melts through the containment vessel then continues down into the earth.
  - k__ 9y ago
    It melts down stuff implemented on bare metal?
- scrollaway 9y ago
  https://meltdownattack.com/ https://meltdownattack.com/ > Why is it called Meltdown? > The bug basically melts security boundaries which are normally enforced by the hardware.
  - contrarian_ 9y ago
    Not a bug according to Intel.
- deleted 9y ago
  [deleted]
- ArchReaper 9y ago
  What does this have to do with politics? 'Meltdown' is a very common term.
mzzter 9y ago
Other domain used to publish the same info: https://meltdownattack.com https://meltdownattack.com
jadedtuna 9y ago
Video demonstration of the Meltdown attack was just taken down: https://www.youtube.com/watch?v=RbHbFkh6eeE https://www.youtube.com/watch?v=RbHbFkh6eeE due to "violating YouTube's policy on spam, deceptive practices, and scams."
- WilliamSt 9y ago
  mirror?
  - levi_n 9y ago
    This tweet has a GIF of the original YT video: https://twitter.com/misc0110/status/948706387491786752 https://twitter.com/misc0110/status/948706387491786752
- 13of40 9y ago
  It's odd that the "LEARN MORE" isn't actually a link.
  - kakarot 9y ago
    Yes it is. It redirects to the Knowledge Base. Check your adblockers. edit: huh that's weird that so many people are getting an error, it works for me across two browsers on both Linux and Windows
    - ajscanlan 9y ago
      Not a link for me either. Even with uBlock and Ghostery turned off. Chrome - Mac OS X Sierra
    - 13of40 9y ago
      Tried with and without uBlock Origin in Chrome, and with no adblocker in Edge, and it's black & white with the "learn more" text but no link. IE renders it correctly as a link. Edit: Sorry for being off-topic, but here's a comparison - https://postimg.org/image/fhb9vlmt1/ https://postimg.org/image/fhb9vlmt1/
saganus 9y ago
I've been reading up a bit on these attacks and I was wondering if there are any particular requirements to implement them in an arbitrary language? For example, can you implement the attack with Java but without JNI? i.e. are syscalls required to be able to leverage the exploit?
Exuma 9y ago
Which one did OSX partially protect against? Also, which one allows JS execution to activate the attack?
- paulhodge 9y ago
  I don’t know what the OSX protection was, but that’s probably Meltdown. Meltdown = using native code to read kernel/system memory. Spectre is the one that can be done with JS.
tzahola 9y ago
The youtube video says: "This video has been removed for violating YouTube's policy on spam, deceptive practices, and scams." LOL!
FrantaH 9y ago
https://meltdownattack.com/meltdown.pdf https://meltdownattack.com/meltdown.pdf https://eprint.iacr.org/2013/448.pdf https://eprint.iacr.org/2013/448.pdf TLDR: Userland process' read access to Ring 0 memory will throw an exception (n.b.: kernel mode memory is actually mapped into process' address space), but before that the instruction reading the memory is actually executed and data are cached. The process can use value of data as an address in userland for another read instruction. Now the process just needs to check range of possible addresses where the data was read from and see how long it takes (using rdtsc) to access them - if it's quick, then we have a match. Is that correct, or am I missing something? e: write changed to 2nd read
whitepoplar 9y ago
How does this affect the end-user security of the apps we use every day, like Gmail, Twitter, GitHub, Stripe, etc.?
- godDLL 9y ago
  All your passwords, are belong to the Internet
dcminter 9y ago
Would a microcode update be possible to fix this? I assume not and that it's fundamental to the speculative execution architecture, but haven't yet seen anything that explicitly addresses the question. Presumably if it is possible then it would reduce any longer term financial consequences for Intel of the problem.
yayks002 9y ago
I found an exploit about meltdown and spectre. very expensive. who buys it http://www.imgup.ru/images2/2ap3x1813955.png http://www.imgup.ru/images2/2ap3x1813955.png is it worth giving $8900
caio1982 9y ago
Does anyone know the amount of dollars involved in the bounty paid by Intel?
sdenton4 9y ago
Well, I'm feeling mighty good about my purchase of a 2011 intel Atom chip back in the day... Now if only I knew which box it's in...
- Symmetry 9y ago
  I wouldn't count on that to be enough. The Atom still speculatively issues and begins execution on instructions past branches and a quick glance at the pipeline[1] makes me think it can start on loads before the branch resolves, the same way an ARM A8 can despite both being in order. [1]https://www.anandtech.com/show/2493/11 https://www.anandtech.com/show/2493/11
jerrac 9y ago
Would cable modems or wireless routers be vulnerable? My router's specification page does not list what CPU it uses. Haven't checked on my modem yet.
- rdudek 9y ago
  I don't think those use x86 chips so they should be OK.
- Tloewald 9y ago
  Everything is vulnerable to Spectre.
  - deleted 9y ago
    [deleted]
  - juergbi 9y ago
    Not everything. In-order CPUs such as Cortex-A7 and Cortex-A53 are not affected. Confirmed by Arm at https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update "all other Arm cores are NOT affected"
    - Tloewald 9y ago
      Doesn’t Spectre just require speculative fetching? In which case in order is not sufficient as to guarantee immunity. It’s Meltdown that relies on out of order execution. https://meltdownattack.com/meltdown.pdf https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf https://spectreattack.com/spectre.pdf
- chowells 9y ago
  In order to be vulnerable, a system needs to run malicious code. This is an especially big deal in the context of virtual machines in shared hosting, because you have no idea what code is running in other virtual machines on the same host. It also impacts end-user systems because the web is basically 100% untrusted code. Even if the cpu in your router is vulnerable, what untrusted code is it expected to run? None of this is to say it's not something that should be fixed. But it's low priority, as it requires the ability to execute code remotely already.
akeck 9y ago
Are the chips used by Intel Management Engines subject to these attacks as well?
- algorithmsRcool 9y ago
  Yes, but the two have nothing to do with each other.
  - deleted 9y ago
    [deleted]
herodotus 9y ago
Practical questions for ordinary users: as I understand it, a malicious actor could inject Javascript into a web site which could read all my computers memory. To read, for example, my bank credentials, would they have to be sitting in memory at the time the malicious code was executed? Could I mitigate this risk by, for example, quitting my browser and relaunching it after visiting my bank? Or will my unencrypted password still potentially be lingering somewhere in memory? Could vendors provide a "memory cleaner" that I could use between web site visits?
- schoen 9y ago
  Typical allocator free() calls don't actually overwrite the memory, meaning that the data stays there until it happens to get overwritten by a future process, which is an unpredictable event. When I was doing research on the cold boot attacks I did a lot of "strings /dev/mem" and would notice stuff related to things I was working on several days ago. As our cold boot paper described, this could sometimes include things that you were doing even before the computer was last rebooted. There is a really nice paper on this particular topic https://benpfaff.org/papers/shredding.html/index.html https://benpfaff.org/papers/shredding.html/index.html which describes some useful countermeasures which haven't been widely implemented. If they had been, they could have somewhat reduced the impact of opportunistic exploitation of memory disclosure vulnerabilities.
Kiro 9y ago
Marked as dupe? Seriously?
dolguldur 9y ago
Skimming the flush+reload paper I see how timing alone is enough to get e.g. a private key if the underlying algorithms are known and prone to revealing what they're working on. Meltdown however seems to be able to arbitrarily read memory (at about ~500 kB/s). How does this work that it can read from the cache?
Indolat 9y ago
So far the possibility of JavaScript attacks looks the biggest concern for the normal users. (Assuming that you don't install any software from fishy sources, of course). And cloud service and virtualization service providers are under the biggest threat.
ArchReaper 9y ago
Admins: why did you take this down? The previous submission didn't get any attention and this had some good discussion.
xingwang 9y ago
Just want to share an technical article about meltdown with things that isn't covered in the white paper. https://www.moesif.com/blog/technical/cpu-arch/What-Is-The-Actual-Vulnerability-Behind-Meltdown/ https://www.moesif.com/blog/technical/cpu-arch/What-Is-The-A...

347 points by dustinmoris 9y ago

Besides the LWN article Notes from the Intelpocalypse [1] this is the best high level overview I've seen for now. Here is are a few quotes (emphasis mine): Am I affected by the bug? Most certainly, yes. Can I detect if someone has exploited Meltdown or Spectre against me? Probably not. The exploitation does not leave any traces in traditional log files. What can be leaked? If your system is affected, our proof-of-concept exploit can read the memory content of your computer. This may include passwords and sensitive data stored on the system. Which systems are affected by Meltdown? Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown. Which systems are affected by Spectre? Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors. Which cloud providers are affected by Meltdown? Cloud providers which use Intel CPUs and Xen PV as virtualization without having patches applied. Furthermore, cloud providers without real hardware virtualization, relying on containers that share one kernel, such as Docker, LXC, or OpenVZ are affected. Why is it called Meltdown? The bug basically melts security boundaries which are normally enforced by the hardware. Why is it called Spectre? The name is based on the root cause, speculative execution. As it is not easy to fix, it will haunt us for quite some time. [1] https://lwn.net/SubscriberLink/742702/e23889188fce9f7f/ https://lwn.net/SubscriberLink/742702/e23889188fce9f7f/

protomyth 9y ago
I wonder if any of the companies the build their own ARM cores are not vulnerable?
arca_vorago 9y ago
I don't see user-mode linux, QEMU, or KVM on that list, or am I mistaken an they are affected as well(so maybe some amd users are safe?). Another reason I advocate every spinup should have FDE by default with a ssh key entry shimmy at initram, or is this runtime cpu acccess so it gets anything live? If so that's scary.

dimillian 9y ago

How would one exploit a Google Cloud physical machine for example? One would still need to inject/patch a file to exploit processor right?

DevNullDevice 9y ago
Meltdown doesn't _directly_ allow modification of code. However, a guest VM could run userspace code that accesses ring 0 / kernel memory of the hypervisor / physical machine. This would mean that security certificates, passwords, etc of the hypervisor could be exposed, which could then allow compromise.
- levi_n 9y ago
  I would also assume this means exploits on a machine provisioned with multiple VMs from different customers would allow a malicious customer to leak data from another customer's VM located on the same machine.

deadmetheny 9y ago

As an aside, I wish that anyone who is responsible for the creation of a cutesy logo for a software vulnerability were able to be punished by having said logo tattooed on their forehead and given a giant nuclear wedgie for being such an insufferable dweeb.

eej71 9y ago
There is value in being able to package up the issue into something that is understandable and presentable to a larger non-technical audience. If a "cutesy logo" increases interest and engagement from a larger non-technical community, I'll take it.
- JorgeGT 9y ago
  Research has concluded that naming storms/hurricanes results in a much better public response. People is more likely to take preventive action against "Storm Eleanor", rather that against an unnamed bad weather report, plus a name allows people to differentiate simultaneous events. In the same way, it is not far fetched to think that a name and logo are much more likely to convince users to quickly apply patches etc. than just CVE-2017-5753, CVE-2017-5715 & CVE-2017-5754. Plus, they are way easier to remember!
  - eej71 9y ago
    Very much agree. The other benefit that I see from the branding is that it serves as a bulwark against the (mis)information that will appear from those who might have a vested interest to downplay it (eg: intel).
swarnie_ 9y ago
"Can I use the logo? Both the Meltdown and Spectre logo are free to use, rights waived via CC0. Logos are designed by Natascha Eibl." I'm sure she would love to hear your opinion personally. Site - https://vividfox.me/ https://vividfox.me/ Email - mail@vividfox.me
sctb 9y ago

djaychela 9y ago

Pleased to see a growing set of links at the bottom for the relevant information for different OSes, etc... However, somewhat surprised that Ubuntu isn't present - done a fair bit of searching today and have only found that the patches are in progress, which I'm a bit surprised about given the disclosure timeline that appears to be in place, and that SuSE and Red Hat seem to have patches in place and ready to go? * EDIT * - since posting this, there is now an Ubuntu link present, and an explanation that they were expecting disclosure on Jan 9th.

brightball 9y ago
That is a little surprising. Definitely making me re-evaluate my choice of local Linux.
- deleted 9y ago
  [deleted]
- RainaRelanah 9y ago
  This was supposed to release on January 9th, but Google pulled the trigger earlier due to community members putting the pieces together and starting to draw press attention. It isn't very fair to blame Ubuntu for being behind.
  - brightball 9y ago
    It’s not just that. I’ve been experimenting with different distros a lot this year (Fedora, Mint and Ubuntu for committed stretches) and Fedora is the only one where the machine didn’t regularly hang for some reason after a few days. Was happening multiple times a day with Ubuntu and currently much less often with Mint. Never happened at all with Fedora though. Between that at Redhats promptness on this it’s just giving me more confidence in that side of the house.
yunyu 9y ago
The linked entry states: The original coordinated disclosure date was planned for January 9 and we have been driving toward that date to release fixes. Due to the early disclosure, we are trying to accelerate the release, but we don't yet have an earlier ETA when the updates will be released. We will release Ubuntu Security Notices when the updates are available.

ashleyn 9y ago

It's not everyday that a security issue is borne out of a side-effect of underlying theory; in this case, how out-of-order execution works. It's almost as bad as if someone proved P = NP, rendering all cryptography useless on the spot. The game is changed forever, and CPU designers across the industry will likely have to can some or all of OoOE, setting performance back considerably. It can take years to reachieve performance we're used to today at the security level required.

zitterbewegung 9y ago
Bare metal servers that run trusted code like a build not are not effected. Maybe this will be a bios setting or a kernel flag to set .
- swsieber 9y ago
  Kernel flag at compile time? - Yes Kernel flag at boot time? - No (the fix is a to compile instructions differently). Bare metal servers that only run trusted code are only unaffected so long as they explicitly opt out of the new security model, and I'm not sure how easy that'll be...
  - FreedomWarrior 9y ago
    IIUC it's not possible to opt out at this time (short of reverting the patches). Linus expressed some concern about it: https://lkml.org/lkml/2018/1/3/797 https://lkml.org/lkml/2018/1/3/797
    - slowmovintarget 9y ago
      What a tl;dr! Please talk to management. Because I really see exactly two possibibilities: - Intel never intends to fix anything OR - these workarounds should have a way to disable them. Which of the two is it?
  - blattimwind 9y ago
    I feel like user-facing server-side scripting languages should be investigated whether they incur the same risk as running JavaScript in a browser (which is big and complicated). I'm thinking about stuff like Sievescript and IFTTT-like applications.

hackermailman 9y ago

The paper on this site is well written explaining the method of using ROP with branch mispredict to load gadgets. Anybody interested in this, ROP, caches and branch prediction/misprediction is all in the intro [1]book[2]course CSApp [1]http://csapp.cs.cmu.edu/3e/labs.html http://csapp.cs.cmu.edu/3e/labs.html [2]http://www.cs.cmu.edu/~213/schedule.html http://www.cs.cmu.edu/~213/schedule.html (Youtube lectures)

neom 9y ago

I understand this "isn't the point" etc - for curiosity sake: How practical are these exploits? From my reading, it seems using them in an attack against a sophisticated target is incredibly difficult, and against an unsophisticated target is still probably prohibitively difficult? I'm not an engineer so please pardon the ignorance.

NoGravitas 9y ago
It looked like one of the proofs of concept was using javascript code to escape the sandbox and read memory from the browser's address space. So that seems to be quite a realistic attack vector, right?
ashleyn 9y ago
Depends on the browser. Chrome has mitigations, but not solutions to this, which largely consist of degrading the quality of the timer required to pull off Spectre. WebWorkers give you a more accurate timing method that can pull it off. Basically, any website can now theoretically read your encryption key in RAM and something like noscript will be required, not optional for maximum safety.
pjc50 9y ago
A nice little gif from twitter: https://twitter.com/misc0110/status/948706387491786752 https://twitter.com/misc0110/status/948706387491786752 User typing into a "secure" Linux (edit: was MacOS - can we do strikethrough here?) password dialog while another process steals the data. The first attack was incredibly difficult, but once there's a proof of concept, copies will proliferate.
- fzzzy 9y ago
  That looks like linux, not mac os. But still.
- arianvanp 9y ago
  That's Gnome, not MacOS ;)
- williamstein 9y ago

chinathrow 9y ago

From the Ubuntu wiki, it's clear that someone broke the coordinated release date of January 9th. Does any one have more insights on why the news broke to soon? https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...

mindcrime 9y ago
IIRC, the Google Project Zero folks went ahead with the announcement early, because what had already leaked / been speculated, was so close to the truth. Apparently a bunch of smart people were paying attention to a recent set of kernel patches, and starting putting "two and two together" relatively quickly, based on the contents of the patches.
Ajedi32 9y ago
From what I recall, patches started showing up in the Linux Kernel, causing lots of buzz and speculation among the security community. People noticed that one patch was only being applied to Intel processors, leading some tech blogs to speculate that only Intel processors were affected by the bug, and that triggered a PR response from Intel. Then someone reverse-engineered an exploit and posted about it on Twitter, and the cat was out of the bag at that point, so they moved up the disclosure timeline.
- baq 9y ago
  And it's a good thing they did that because a motivated black hat with the correct skill set most likely did, too. Not to mention nation state cyber ops.

sveme 9y ago

If I understand it correctly (not entirely sure), an adversary needs to have code running on a system to exploit either attack - would Javascript running in a browser be in principle sufficient to be able to exploit this, or are there some mitigations (sandboxes?) in place to prevent this from happening? Edit: Okay, found this post from yesterday: https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ https://blog.mozilla.org/security/2018/01/03/mitigations-lan... Thanks for the reply!

derekp7 9y ago
Yes, and one of the mitigations is to reduce the precision / accuracy of certain timer calls in Javascript.
ckuehl 9y ago
From the Spectre paper: > As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). https://spectreattack.com/spectre.pdf https://spectreattack.com/spectre.pdf
paulhodge 9y ago
Yes javascript is sufficient. I think Spectre is theoretically possible with just untrusted data (not just untrusted code). It would need an existing trusted program that has a branch-predicting loop like the one in the paper. The attacker would feed untrusted data into the loop and then observe secrets through cache timing. It's weird code, so it's probably unlikely an existing program would have it, but it's not outside the realm of possibility. The attacker would also need a high-precision way to measure the timing of the operation, which also might be hard to find in an existing program, but not impossible. Just something else to keep you awake at night!
- kllrnohj 9y ago
  They need code execution to observe that cache timing, though, and they need to prime the branch predictor and cache.

danso 9y ago

Mostly OT, but is there an explanation for why the "Meltdown" vulnerability was named specifically as such, I mean besides the term's meaning when it comes to "melting" security barriers? Coincidentally, "meltdown" is currently a very popular term to describe reactions/revelations re: a soon-to-be-released politics book titled "Fire and Fury" [0]. I guess yet another example of "Naming things" being one of the hard problems. [0] https://www.publishersweekly.com/pw/by-topic/industry-news/publisher-news/article/75734-pre-orders-for-wolff-s-trump-book-skyrocket-as-trump-has-twitter-meltdown.html https://www.publishersweekly.com/pw/by-topic/industry-news/p...

netman21 9y ago
The term is ominous because it is the common description of what happens when the core of a nuclear reactor overheats and melts. The theoretical result is a molten puddle of fissioning material that melts through the containment vessel then continues down into the earth.
- k__ 9y ago
  It melts down stuff implemented on bare metal?
scrollaway 9y ago
https://meltdownattack.com/ https://meltdownattack.com/ > Why is it called Meltdown? > The bug basically melts security boundaries which are normally enforced by the hardware.
- contrarian_ 9y ago
  Not a bug according to Intel.
deleted 9y ago
[deleted]
ArchReaper 9y ago
What does this have to do with politics? 'Meltdown' is a very common term.

mzzter 9y ago

Other domain used to publish the same info: https://meltdownattack.com https://meltdownattack.com

jadedtuna 9y ago

Video demonstration of the Meltdown attack was just taken down: https://www.youtube.com/watch?v=RbHbFkh6eeE https://www.youtube.com/watch?v=RbHbFkh6eeE due to "violating YouTube's policy on spam, deceptive practices, and scams."

WilliamSt 9y ago
mirror?
- levi_n 9y ago
  This tweet has a GIF of the original YT video: https://twitter.com/misc0110/status/948706387491786752 https://twitter.com/misc0110/status/948706387491786752
13of40 9y ago
It's odd that the "LEARN MORE" isn't actually a link.
- kakarot 9y ago
  Yes it is. It redirects to the Knowledge Base. Check your adblockers. edit: huh that's weird that so many people are getting an error, it works for me across two browsers on both Linux and Windows
  - ajscanlan 9y ago
    Not a link for me either. Even with uBlock and Ghostery turned off. Chrome - Mac OS X Sierra
  - 13of40 9y ago
    Tried with and without uBlock Origin in Chrome, and with no adblocker in Edge, and it's black & white with the "learn more" text but no link. IE renders it correctly as a link. Edit: Sorry for being off-topic, but here's a comparison - https://postimg.org/image/fhb9vlmt1/ https://postimg.org/image/fhb9vlmt1/

saganus 9y ago

I've been reading up a bit on these attacks and I was wondering if there are any particular requirements to implement them in an arbitrary language? For example, can you implement the attack with Java but without JNI? i.e. are syscalls required to be able to leverage the exploit?

Exuma 9y ago

Which one did OSX partially protect against? Also, which one allows JS execution to activate the attack?

paulhodge 9y ago
I don’t know what the OSX protection was, but that’s probably Meltdown. Meltdown = using native code to read kernel/system memory. Spectre is the one that can be done with JS.

tzahola 9y ago

The youtube video says: "This video has been removed for violating YouTube's policy on spam, deceptive practices, and scams." LOL!

FrantaH 9y ago

https://meltdownattack.com/meltdown.pdf https://meltdownattack.com/meltdown.pdf https://eprint.iacr.org/2013/448.pdf https://eprint.iacr.org/2013/448.pdf TLDR: Userland process' read access to Ring 0 memory will throw an exception (n.b.: kernel mode memory is actually mapped into process' address space), but before that the instruction reading the memory is actually executed and data are cached. The process can use value of data as an address in userland for another read instruction. Now the process just needs to check range of possible addresses where the data was read from and see how long it takes (using rdtsc) to access them - if it's quick, then we have a match. Is that correct, or am I missing something? e: write changed to 2nd read

whitepoplar 9y ago

How does this affect the end-user security of the apps we use every day, like Gmail, Twitter, GitHub, Stripe, etc.?

godDLL 9y ago
All your passwords, are belong to the Internet

dcminter 9y ago

Would a microcode update be possible to fix this? I assume not and that it's fundamental to the speculative execution architecture, but haven't yet seen anything that explicitly addresses the question. Presumably if it is possible then it would reduce any longer term financial consequences for Intel of the problem.

yayks002 9y ago

I found an exploit about meltdown and spectre. very expensive. who buys it http://www.imgup.ru/images2/2ap3x1813955.png http://www.imgup.ru/images2/2ap3x1813955.png is it worth giving $8900

caio1982 9y ago

Does anyone know the amount of dollars involved in the bounty paid by Intel?

sdenton4 9y ago

Well, I'm feeling mighty good about my purchase of a 2011 intel Atom chip back in the day... Now if only I knew which box it's in...

Symmetry 9y ago
I wouldn't count on that to be enough. The Atom still speculatively issues and begins execution on instructions past branches and a quick glance at the pipeline[1] makes me think it can start on loads before the branch resolves, the same way an ARM A8 can despite both being in order. [1]https://www.anandtech.com/show/2493/11 https://www.anandtech.com/show/2493/11

jerrac 9y ago

Would cable modems or wireless routers be vulnerable? My router's specification page does not list what CPU it uses. Haven't checked on my modem yet.

rdudek 9y ago
I don't think those use x86 chips so they should be OK.
Tloewald 9y ago
Everything is vulnerable to Spectre.
- deleted 9y ago
  [deleted]
- juergbi 9y ago
  Not everything. In-order CPUs such as Cortex-A7 and Cortex-A53 are not affected. Confirmed by Arm at https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update "all other Arm cores are NOT affected"
  - Tloewald 9y ago
    Doesn’t Spectre just require speculative fetching? In which case in order is not sufficient as to guarantee immunity. It’s Meltdown that relies on out of order execution. https://meltdownattack.com/meltdown.pdf https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf https://spectreattack.com/spectre.pdf
chowells 9y ago
In order to be vulnerable, a system needs to run malicious code. This is an especially big deal in the context of virtual machines in shared hosting, because you have no idea what code is running in other virtual machines on the same host. It also impacts end-user systems because the web is basically 100% untrusted code. Even if the cpu in your router is vulnerable, what untrusted code is it expected to run? None of this is to say it's not something that should be fixed. But it's low priority, as it requires the ability to execute code remotely already.

akeck 9y ago

Are the chips used by Intel Management Engines subject to these attacks as well?

algorithmsRcool 9y ago
Yes, but the two have nothing to do with each other.
- deleted 9y ago
  [deleted]

herodotus 9y ago

Practical questions for ordinary users: as I understand it, a malicious actor could inject Javascript into a web site which could read all my computers memory. To read, for example, my bank credentials, would they have to be sitting in memory at the time the malicious code was executed? Could I mitigate this risk by, for example, quitting my browser and relaunching it after visiting my bank? Or will my unencrypted password still potentially be lingering somewhere in memory? Could vendors provide a "memory cleaner" that I could use between web site visits?

schoen 9y ago
Typical allocator free() calls don't actually overwrite the memory, meaning that the data stays there until it happens to get overwritten by a future process, which is an unpredictable event. When I was doing research on the cold boot attacks I did a lot of "strings /dev/mem" and would notice stuff related to things I was working on several days ago. As our cold boot paper described, this could sometimes include things that you were doing even before the computer was last rebooted. There is a really nice paper on this particular topic https://benpfaff.org/papers/shredding.html/index.html https://benpfaff.org/papers/shredding.html/index.html which describes some useful countermeasures which haven't been widely implemented. If they had been, they could have somewhat reduced the impact of opportunistic exploitation of memory disclosure vulnerabilities.

Kiro 9y ago

Marked as dupe? Seriously?

dolguldur 9y ago

Skimming the flush+reload paper I see how timing alone is enough to get e.g. a private key if the underlying algorithms are known and prone to revealing what they're working on. Meltdown however seems to be able to arbitrarily read memory (at about ~500 kB/s). How does this work that it can read from the cache?

Indolat 9y ago

So far the possibility of JavaScript attacks looks the biggest concern for the normal users. (Assuming that you don't install any software from fishy sources, of course). And cloud service and virtualization service providers are under the biggest threat.

ArchReaper 9y ago

Admins: why did you take this down? The previous submission didn't get any attention and this had some good discussion.

xingwang 9y ago

Just want to share an technical article about meltdown with things that isn't covered in the white paper. https://www.moesif.com/blog/technical/cpu-arch/What-Is-The-Actual-Vulnerability-Behind-Meltdown/ https://www.moesif.com/blog/technical/cpu-arch/What-Is-The-A...