4 ms·

> Intel said its chips, which power Macs and devices from other manufacturers, contain the flaw as well as processors based on ARM Holdings architecture, which

> Intel said its chips, which power Macs and devices from other manufacturers, contain the flaw as well as processors based on ARM Holdings architecture, which is used in iOS devices and Android smartphones. Has it been proven that Meltdown can affect ARM processors, or is this Intel speculation?

Kocrachon 9y ago
It can impact them, just not to the same extreme. I believe ARM is only impacted when data is user space to user space.
gmartres 9y ago
According to ARM yes, but only on a few architectures: https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update (Meltdown is CVE-2017-5754 and is responsible for Variant 3 and Variant 3a). See also https://github.com/marcan/speculation-bugs/blob/master/README.md https://github.com/marcan/speculation-bugs/blob/master/READM... which tries to summarize every known attack/platform/mitigation.
Kikawala 9y ago
Meltdown affects Intel chips, Spectre affects Intel, AMD, and ARM chips.
- Xorlev 9y ago
  Spectre likely affects any chip with speculative execution, regardless of vendor, even things like Power8. So that's fun.
  - ksec 9y ago
    "We have people everywhere" - Mr White. Did Google name it Spectre after the the James Bond movie? And I thought AMD put out a release saying they are not affected.
    - Mindwipe 9y ago
      I imagine it was named Spectre because it's going to be haunting us for years to come.
- gmartres 9y ago
  Meltdown also affects some ARM chips according to ARM itself: https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update
smallnamespace 9y ago
Cache timing attacks are a pretty general technique, and just depends on the combination of speculative execution + not flushing the cache upon misprediction rollback (which would be very expensive). It would be a huge surprise if ARM were somehow immune.
cbhl 9y ago
Google tested a Proof-of-Concept exploit against an ARM Cortex A57. https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.com/2018/01/reading-privi... disclaimer: I work at Google, but not on Project Zero.

Kocrachon 9y ago

It can impact them, just not to the same extreme. I believe ARM is only impacted when data is user space to user space.

gmartres 9y ago

According to ARM yes, but only on a few architectures: https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update (Meltdown is CVE-2017-5754 and is responsible for Variant 3 and Variant 3a). See also https://github.com/marcan/speculation-bugs/blob/master/README.md https://github.com/marcan/speculation-bugs/blob/master/READM... which tries to summarize every known attack/platform/mitigation.

Kikawala 9y ago

Meltdown affects Intel chips, Spectre affects Intel, AMD, and ARM chips.

Xorlev 9y ago
Spectre likely affects any chip with speculative execution, regardless of vendor, even things like Power8. So that's fun.
- ksec 9y ago
  "We have people everywhere" - Mr White. Did Google name it Spectre after the the James Bond movie? And I thought AMD put out a release saying they are not affected.
  - Mindwipe 9y ago
    I imagine it was named Spectre because it's going to be haunting us for years to come.
gmartres 9y ago
Meltdown also affects some ARM chips according to ARM itself: https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update

smallnamespace 9y ago

Cache timing attacks are a pretty general technique, and just depends on the combination of speculative execution + not flushing the cache upon misprediction rollback (which would be very expensive). It would be a huge surprise if ARM were somehow immune.

cbhl 9y ago

Google tested a Proof-of-Concept exploit against an ARM Cortex A57. https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.com/2018/01/reading-privi... disclaimer: I work at Google, but not on Project Zero.