13 ms·
About speculative execution vulnerabilities in ARM-based and Intel CPUs
- deleted 9y ago[deleted]
- MBCook 9y agoThey say the watches aren’t effected. Is it possible that they don’t do speculative execution?
- trynumber9 9y agoThat's probably it. The original S1 was based on the A7 which was in-order. But I can't find information on the S2 onward.
- kridsdale 9y agoI don’t have any citations but I believe the S1 is actually based on the A4 of all things. It was 32 bit.
- blattimwind 9y agoHighly unlikely. > Apple Watch is not affected by Meltdown. i.e. by the lemma of overly specific dementi it follows that Apple Watch is affected by Spectre.
- jmull 9y agoI think it's only Meltdown that the watch isn't affected by. It sounds like it is potentially affected by Spectre, especially since they say they will be continuing to develop mitigations for WatchOS. The surprising thing to me is that they patched iOS to mitigate Meltdown. Before now, I thought it was only Intel chips that were affected by Meltdown, but I guess Apple's own A-series processors are affected too.
- pkaye 9y agoYes some ARM Cortex A-series are affected by a variant of Meltdown. https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update
- tischler 9y ago> Apple has already released mitigations in iOS 11.2, macOS 10.13.2, and tvOS 11.2 to help defend against Meltdown. What about macOS 10.12 and earlier versions?
- dylz 9y agoMy work machine is 10.12 and patched today. Sierra and El Capitan is covered too. https://support.apple.com/en-us/HT208331 https://support.apple.com/en-us/HT208331 - see Kernel entries.
- tischler 9y ago10.12 is Sierra. I cannot see any security update in the updates tab of the App Store app, nor in the list of updates that were installed in the last 30 days.
- om2 9y agoThis update shipped to 10.12 on Dec 6 as 10.12.7.
- hesk 9y agoOnly fixes Meltdown but not Spectre.
- jonny_eh 9y agoThey said that they've only patched Meltdown so far.
- tischler 9y agoI'm on 10.12.6 on a Mid 2011 MacBook Air 13": "No Updates Available" Edit: I see, there is a confusing typo in om2's comment (it should be 10.12.6 not 10.12.7). I am wondering why this update does not show up in my list of installed updates. What a mess.
- lowbloodsugar 9y agoSo, older versions not fixed? Who is most likely to be running older version? Corporations? Ah, they probably don't care.
- coldcode 9y agoSierra and El Capitan are covered too.
- lowbloodsugar 9y agoDo you have a source for that because: a) The article above doesn't mention it (specifically says 10.13), and b) There are no updates available for my mac.
- cls59 9y agoI'm running an older version because I prefer to let other folks grind the rough edges off of the APFS filesystem before taking the plunge myself.
- nnx 9y agoInteresting that this seems to say that A-series processors are vulnerable to Meltdown (or a variant of it). Could this “check later” speculative approach similar to Intel’s explain Apple’s great performance advantage over other ARM CPUs?
- mbroncano 9y agoIt's mostly assumed the refered performance advantage is directly related to the better and bigger caches in the microprocessor. I'd be surprised that their OOO technique is fundamentally different than other vendors.
- duskwuff 9y ago> Could this “check later” speculative approach similar to Intel’s explain Apple’s great performance advantage over other ARM CPUs? No. Speculative execution is not unique to Apple's SoC designs; it's present in other ARM cores as well. https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update
- chx 9y ago> but there are no known exploits impacting customers at this time known by whom? Apple? Then say "we do not know of any exploits". Is the answer different for the NSA? Who the f knows?
- blinkingled 9y agoSo nothing required on hardware side? I was under the impression that OEMs need to send out BIOS/UEFI Firmware updates or at least CPU Microcode updates but doesn't look like Apple is planning to do so.
- nly 9y agoMicrocode updates will come down the pipe to users as OS updates as Intel uses these channels.
- blinkingled 9y agoYeah I think if a UEFI update comes down it might bring the mitigated uCode with it. Just got to boot into USB macOS installation - don't think Boot Camp users get those updates.
- kridsdale 9y agoMacOS update packages include any relevant firmware updates at the same time.
- earenndil 9y agoAt least in the linux kernel, it was patched by essentially throwing off the branch predictor following every syscall, which didn't require any hardware, bios, or microcode patches.
- AaronFriel 9y ago> Our testing with public benchmarks has shown that the changes in the December 2017 updates resulted in no measurable reduction in the performance of macOS and iOS as measured by the GeekBench 4 benchmark, or in common Web browsing benchmarks such as Speedometer, JetStream, and ARES-6. This is incredibly deceptive, because web workloads are precisely the sort not expected to be impacted by Meltdown most. As I've written elsewhere, it's syscall heavy workloads targeting fast devices, like database software on PCIe SSDs, that will suffer the greatest slowdowns.
- empthought 9y agoThis spells certain doom for Apple’s vaunted supremacy in supplying high-performance hardware for database usage.
- jmull 9y ago> it's syscall heavy workloads targeting fast devices, like database software on PCIe SSDs, that will suffer the greatest slowdowns. That's not exactly a common scenario for macOS, much less iOS devices. It's fair to call for benchmarks that are more representative of common workloads, not less representative.
- Analemma_ 9y ago> Since exploiting many of these issues requires a malicious app to be loaded on your Mac or iOS device, we recommend downloading software only from trusted sources such as the App Store Haven’t there been JavaScript POCs for Meltdown? That’s already patched and AFAIK there’s nothing for Spectre yet, but this is still a little disingenuous.
- acdha 9y agoAren’t the browser patches already shipping? The JS risk should be significantly lower with days.
- drdrey 9y agoI must say I am pleasantly surprised by the straightforward, no BS language
- Waterluvian 9y agoIt was better. I'm confused how the title says Intel and ARM but the first paragraph says all processors.
- alsetmusic 9y ago> It was better. I'm confused how the title says Intel and ARM but the first paragraph says all processors. These are the processors found in Apple products. Yesterday, there were comments [edit: on HN] about the Intel PR announcement that were critical of the fact that Intel name-dropped AMD in what was thought to be an attempt to deflect the issue from the Intel brand.
- Aloha 9y agoI am as well - this is something I can link to people who do not understand microarchitectures, so they can understand what these bugs are.
- tischler 9y agoExcept they forgot to tell us about older versions of macOS which probably 75%[1] of Apple users still use. [1] http://gs.statcounter.com/macos-version-market-share/desktop/worldwide http://gs.statcounter.com/macos-version-market-share/desktop...
- thelibrarian 9y agoSecurity Updates were released for 10.6 and 10.5 (2017-002 and 2017-005 respectively).
- 0x0 9y agoWhere do you see updates for 10.6 and 10.5? According to https://support.apple.com/en-us/HT208331 https://support.apple.com/en-us/HT208331 - there was a 2017-002 for 10.12 and a 2017-005 for 10.11.
- walterbell 9y agoWhat about iOS10 users who need to run 32-bit apps?
- scarface74 9y agoHow long has Apple warned users that 32 bit software wasn't going to be supported? For context, the only phones that are not being supported by the latest patch are iPhones introduced before 2013.
- walterbell 9y agoIf the app vendor has gone out of business and there is substantial data in the 32-bit app, there may be no upgrade alternative.
- scarface74 9y agoAnd can you name a few real world examples?
- walterbell 9y agoSeveral are named here: https://tidbits.com/article/17342 https://tidbits.com/article/17342
- scarface74 9y agoI haven't dug into the list too carefully but would you really use a productivity app from a small company that doesn't have anyway to export the data? Even my third party podcast client supports exporting to OPML.
- deleted 9y ago[deleted]
- draw_down 9y agoWell, yeah. It affects a lot of computers.
- torgard 9y ago> Intel said its chips, which power Macs and devices from other manufacturers, contain the flaw as well as processors based on ARM Holdings architecture, which is used in iOS devices and Android smartphones. Has it been proven that Meltdown can affect ARM processors, or is this Intel speculation?
- Kocrachon 9y agoIt can impact them, just not to the same extreme. I believe ARM is only impacted when data is user space to user space.
- gmartres 9y agoAccording to ARM yes, but only on a few architectures: https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update (Meltdown is CVE-2017-5754 and is responsible for Variant 3 and Variant 3a). See also https://github.com/marcan/speculation-bugs/blob/master/README.md https://github.com/marcan/speculation-bugs/blob/master/READM... which tries to summarize every known attack/platform/mitigation.
- Kikawala 9y agoMeltdown affects Intel chips, Spectre affects Intel, AMD, and ARM chips.
- Xorlev 9y agoSpectre likely affects any chip with speculative execution, regardless of vendor, even things like Power8. So that's fun.
- ksec 9y ago"We have people everywhere" - Mr White. Did Google name it Spectre after the the James Bond movie? And I thought AMD put out a release saying they are not affected.
- 9y ago
- imagetic 9y agoWhat about macOS 10.12? I haven't seen enough stability across applications with High Sierra to make the upgrade for work machines. I guess we'll have to just wait it out to see what they actually release.
- om2 9y agoIt's gotten the same patches as 10.13. The original security advisory did not mention it, but it's been revised now: https://support.apple.com/en-us/HT208331 https://support.apple.com/en-us/HT208331 Kernel Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X El Capitan 10.11.6 Impact: An application may be able to read kernel memory Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. CVE-2017-5754: Jann Horn of Google Project Zero, Werner Haas and Thomas Prescher of Cyberus Technology GmbH, and Daniel Gruss, Moritz Lipp, Stefan Mangard and Michael Schwarz from Graz University of Technology
- klondike_ 9y agoI wonder what's going to happen to old Android devices that are no longer receiving security updates
- walterbell 9y agoIf there are no global, industry-wide incentives to fix this particular, once-in-twenty-years issue, they become the world's largest botnet. Apple and Google should want old devices to be patched, to avoid teaching consumers that their devices cannot be trusted.
- workthrowaway27 9y agoThere's no remote exploit though, right? So the only way an attacker could turn this into a botnet would be to somehow get Android apps to run attacker controlled code or exploit existing code that fits the pattern described in the attacks (seems not to exist in practice). These aren't super high bars, but they do make the exploit significantly harder.
- jimmaswell 9y agoCouldn't old Android web browsers be targeted?
- workthrowaway27 9y agoIt seems like it (didn't see that there was a JS version of the exploit until after I posted), although they can only read from the address space of the process the JS code is running in. I think tabs get individual processes (in Chrome at least), not sure about Firefox or other browsers, so I'm not sure how bad this is in practice.
- jacksmith21006 9y agoGoogle will on their pixel phones. But the other OEMs tend to not be good about updates. A big plus for the Pixel in the Android world.
- kilon 9y agoDamn it’s 2000 all over again. Cybermagedon is the most annoying thing. It always appears when I am in low supply of pop corn.
- bitL 9y agoHmm, so Apple confirms that meltdown happens on ARM as well, interesting. Likely their Axx chips are way faster than competition, allowing the timing window in which to execute the attack, as Google suggested.
- jlouis 9y agoThe speed isn't the issue. It is all about speculation and prediction
- HugoDaniel 9y agoDoes Geekbench test for TLB flushes at syscalls or whatever other kind of "mitigation" they introduced in 10.13.2 ? Where can we see true benchmarks of performance comparison between previous and current version in regards to this bug ? Isn't Apple being really nasty by exploiting the lack of knowledge of the general public ? I am no expert in any way but would like to know how did they "mitigated" this without a serious performance hit.
- brigade 9y agoMore like Phoronix doesn’t do any analysis of what they’re benchmarking and the general public quoting them can’t do that for them. Besides, syscalls have historically been slow on OS X; back when the kernel was 32-bit the kernel and user space had completely separate address spaces (unlike windows and default Linux) and I’ll bet even most power users never realized.
- Strom 9y agoYou should try defining this mystical true benchmark that you seek. Apple decided that heavy userspace execution and web performance are representative of common workloads. You are welcome to argue for a different kind of workload. As it stands now, at best you're implying that it's common for users to execute syscalls in a loop.
- HugoDaniel 9y agoCan you tell with any degree of precision what kind of benchmark the "GeekBench" is and does ? What guarantees do you have that it is testing "real world common workloads" ? Do you think common users execute guassian blurs in a loop and ray tracers before perfoming rigid body physics in their "common workloads" ? As you said, I know I am welcome to argue for a different kind of workload, specially when I am being taken for a fool.
- Strom 9y agoI'm not too familiar with GeekBench, but I'm assuming it's userspace code. Whether it traces rays or does something else isn't that important, because the slowdown is with syscalls. As for what common users execute, based on my observations over the years it's mostly web browsing. However my personal vision of common workloads is a distraction. I have made no claims to know common workloads. I merely stated that Apple has chosen a particular set to be representative.
- jluxenberg 9y agoApple patched Meltdown (not Spectre) for Sierra in "Security Update 2017-002" on Dec. 6th 2017. They are not doing a point release; the latest version of Sierra is 10.12.6 If you want to check that you have installed this update, you can use the following command: $ system_profiler | grep 'Security Update 2017-002'
- liamzebedee 9y agoAre secrets within the secure enclave vulnerable? e.g. Bitcoin wallet keys
- Jyaif 9y agoI wonder if Apple can retro-actively add the retpoline trick to the apps submitted in bitcode. If so, then I expect Apple to make bitcode mandatory.