4 ms·

> Intel products are uniquely vulnerable to the meltdown attack More precisely, there is only a PoC for Intel at this time. AMD processors are believed to not

> Intel products are uniquely vulnerable to the meltdown attack More precisely, there is only a PoC for Intel at this time. AMD processors are believed to not be vulnerable. Some ARM processors _are_ believed to be vulnerable. > for most CPUs you can attack userspace processes with these techniques Spectre can attack the kernel as well, at least according to http://www.tomshardware.com/news/meltdown-spectre-exploits-intel-amd-arm-nvidia,36219.html http://www.tomshardware.com/news/meltdown-spectre-exploits-i... . It's just harder to use than meltdown.

arohner 9y ago
That link no longer loads for me. AIUI, Spectre can be used to attack the kernel, only if you can get code running in kernel-space, via, e.g. eBPF.
- contrarian_ 9y ago
  No, you could also find a gadget with ROP techniques. The eBPF thing in the paper was purely due to convenience of exploitation.
- bzbarsky 9y ago
  > That link no longer loads for me. Oh, right, ycombinator's URL parser is broken. I fixed the link to work around the buggy parser....
- elihu 9y ago
  I think that's almost but not quite exactly right. Spectre variant 2 attacks vulnerable indirect jump code patterns that exist in the kernel (or some other process), but doesn't require running the attacker's code. Spectre variant 1 allows you to infer the contents of memory in the same address space, so that's the one where you'd use eBPF to attack the kernel. Meltdown (variant 3) if I understand correctly can infer memory contents of other address spaces without relying on any assumptions about the code running in the other address space. https://security.googleblog.com/2018/01/more-details-about-mitigations-for-cpu_4.html https://security.googleblog.com/2018/01/more-details-about-m...
swsieber 9y ago
I'm curious about AMD not being vulnerable, mostly because this page: https://www.kb.cert.org/vuls/id/584653 https://www.kb.cert.org/vuls/id/584653 makes me think that AMD has admitted to being vulnerable.
- bzbarsky 9y ago
  That page talks about both Meltdown and Spectre, as far as I can tell. AMD is vulnerable to Spectre; everyone agrees on that. According to https://www.amd.com/en/corporate/speculative-execution https://www.amd.com/en/corporate/speculative-execution AMD claims it's not vulnerable to Meltdown (aka "Variant Three").
- milcron 9y ago
  See this mailing list post https://lkml.org/lkml/2017/12/27/2 https://lkml.org/lkml/2017/12/27/2

arohner 9y ago

That link no longer loads for me. AIUI, Spectre can be used to attack the kernel, only if you can get code running in kernel-space, via, e.g. eBPF.

contrarian_ 9y ago
No, you could also find a gadget with ROP techniques. The eBPF thing in the paper was purely due to convenience of exploitation.
bzbarsky 9y ago
> That link no longer loads for me. Oh, right, ycombinator's URL parser is broken. I fixed the link to work around the buggy parser....
elihu 9y ago
I think that's almost but not quite exactly right. Spectre variant 2 attacks vulnerable indirect jump code patterns that exist in the kernel (or some other process), but doesn't require running the attacker's code. Spectre variant 1 allows you to infer the contents of memory in the same address space, so that's the one where you'd use eBPF to attack the kernel. Meltdown (variant 3) if I understand correctly can infer memory contents of other address spaces without relying on any assumptions about the code running in the other address space. https://security.googleblog.com/2018/01/more-details-about-mitigations-for-cpu_4.html https://security.googleblog.com/2018/01/more-details-about-m...

swsieber 9y ago

I'm curious about AMD not being vulnerable, mostly because this page: https://www.kb.cert.org/vuls/id/584653 https://www.kb.cert.org/vuls/id/584653 makes me think that AMD has admitted to being vulnerable.

bzbarsky 9y ago
That page talks about both Meltdown and Spectre, as far as I can tell. AMD is vulnerable to Spectre; everyone agrees on that. According to https://www.amd.com/en/corporate/speculative-execution https://www.amd.com/en/corporate/speculative-execution AMD claims it's not vulnerable to Meltdown (aka "Variant Three").
milcron 9y ago
See this mailing list post https://lkml.org/lkml/2017/12/27/2 https://lkml.org/lkml/2017/12/27/2