4 ms·
I'm sure the initial reaction here is going to be lamentation about the state of documentation. People will correctly point out that, if multiple entities misre
by darkerside 9y ago
I'm sure the initial reaction here is going to be lamentation about the state of documentation. People will correctly point out that, if multiple entities misread the documentation, it just have been unclear. And they are right. But that doesn't make this Intel's fault alone. Clear or unclear, the documentation described behavior that was understood at the Intel organization, and the shipped product worked as described.
Where was the security testing at the OS level? Why can't there be automated test suites that catch unauthorized access issues before ship (if not before merge commit)? If your vendor delivers an insecure product and you don't discover it, how much blame do you share?
- sillysaurus3 9y agoWhy can't there be automated test suites that catch unauthorized access issues before ship (if not before merge commit)? Usually the search space is too large.
- rocqua 9y agoIsn't that what fuzzing is for?
- amluto 9y agoI’d be truly amazed if a fuzzer could have caught this one. You need to invoke debug syscalls with the right parameters and the do a magic two-to-three instruction sequence.
- learningto 9y agoIt's what formal verification is for!
- hedora 9y agoConcolic testing would probably catch it, but only if the person that implemented the hardware model for the theorem prover understood the Intel documentation, which seems unlikely. Basic fuzzing probably wouldn’t catch this; as the other comments point out, the search space is probably too large, and the set of vulnerable executions is probably too small for an undirected random search.
- throwaway2048 9y agoYour idea is akin to searching the space of unknown unknowns, By definition someone can not even begin to quantify the space of what you don't know you don't know.
- empath75 9y agoIt’s as simple as determining if a given program will halt.
- dboreham 9y agoYou forgot to include the sarcasm flag. I suppose "tag" these days, right?
- simion314 9y agoIf you can't trust the CPU documentation how can you test that addition works? even if you could test all possible combinations of terms to add and verify the results there may be a hidden flag somewhere that when flipped will change how addition works.
- Tobba_ 9y agoOn that subject, I'm curious whether there is any CPU out there that sets the overflow flag incorrectly when computing (-1) - n when n is the most negative number (which negates to itself, so implementing subtraction by simply negating the RHS and adding will screw up the flags).
- Vogtinator 9y agoThe ARM ARM documents sub(left, right, no carry) as add(left, ~right, carry set), which is also the most straightforward implementation if you have to account for carry anyway.
- hedora 9y agoThis mentality is why I like OpenBSD. If they can’t sign off on the security/correctness of a pile of code, they delete it, even if it means losing functionality. In this case, they simply didn’t invoke the incomprehensible instruction of doom.