5 ms·
The effect on Intel is far more severe than on other architectures. There were three vulnerabilities, two grouped together as "spectre" and one called "meltdow
by betterunix2 9y ago
The effect on Intel is far more severe than on other architectures. There were three vulnerabilities, two grouped together as "spectre" and one called "meltdown." Intel products are uniquely vulnerable to the meltdown attack, while many CPUs are vulnerable to spectre. The summary AFAIUI is that for most CPUs you can attack userspace processes with these techniques (think Javascript running in a browser), while for Intel CPUs you can also attack the kernel. Intel CPUs also seem to be somewhat easier to attack than others because of a higher-bandwidth side channel.
- Symmetry 9y agoA minor correction, ARM's upcoming A75 core looks like it will be vulnerable to Meltdown too. But since it isn't intended for use on server workloads the performance impact of the fix shouldn't be very significant.
- bzbarsky 9y ago> Intel products are uniquely vulnerable to the meltdown attack More precisely, there is only a PoC for Intel at this time. AMD processors are believed to not be vulnerable. Some ARM processors _are_ believed to be vulnerable. > for most CPUs you can attack userspace processes with these techniques Spectre can attack the kernel as well, at least according to http://www.tomshardware.com/news/meltdown-spectre-exploits-intel-amd-arm-nvidia,36219.html http://www.tomshardware.com/news/meltdown-spectre-exploits-i... . It's just harder to use than meltdown.
- arohner 9y agoThat link no longer loads for me. AIUI, Spectre can be used to attack the kernel, only if you can get code running in kernel-space, via, e.g. eBPF.
- contrarian_ 9y agoNo, you could also find a gadget with ROP techniques. The eBPF thing in the paper was purely due to convenience of exploitation.
- bzbarsky 9y ago> That link no longer loads for me. Oh, right, ycombinator's URL parser is broken. I fixed the link to work around the buggy parser....
- elihu 9y agoI think that's almost but not quite exactly right. Spectre variant 2 attacks vulnerable indirect jump code patterns that exist in the kernel (or some other process), but doesn't require running the attacker's code. Spectre variant 1 allows you to infer the contents of memory in the same address space, so that's the one where you'd use eBPF to attack the kernel. Meltdown (variant 3) if I understand correctly can infer memory contents of other address spaces without relying on any assumptions about the code running in the other address space. https://security.googleblog.com/2018/01/more-details-about-mitigations-for-cpu_4.html https://security.googleblog.com/2018/01/more-details-about-m...
- swsieber 9y agoI'm curious about AMD not being vulnerable, mostly because this page: https://www.kb.cert.org/vuls/id/584653 https://www.kb.cert.org/vuls/id/584653 makes me think that AMD has admitted to being vulnerable.
- bzbarsky 9y agoThat page talks about both Meltdown and Spectre, as far as I can tell. AMD is vulnerable to Spectre; everyone agrees on that. According to https://www.amd.com/en/corporate/speculative-execution https://www.amd.com/en/corporate/speculative-execution AMD claims it's not vulnerable to Meltdown (aka "Variant Three").
- milcron 9y agoSee this mailing list post https://lkml.org/lkml/2017/12/27/2 https://lkml.org/lkml/2017/12/27/2
- cma 9y ago"(at least for the spectre attack)"
- swsieber 9y agoI did not realize that Intel CPU's also open up the kernel to the Spectre attack, while others don't. That's noteworthy.