3 ms·
Do we have PoC code? Has anyone tried attacking FP/SIMD state on other ISAs like Power or AArch64?
by andreiw 8y ago
Do we have PoC code? Has anyone tried attacking FP/SIMD state on other ISAs like Power or AArch64?
- cperciva 8y agoI have exploit code -- took me about 5 hours to write after Theo announced all the important details of the vulnerability. I'm not going to publish it yet, though. AFAIK other systems aren't affected -- is lazy context switching even a thing on them? The fundamental issue here is that one process' data is still in registers when another process is running and we've been relying on getting a trap to tell us when we need to restore the correct FP state.
- monocasa 8y agoLazy context switching is a thing on pretty much every architecture with an FPU.
- cperciva 8y agoHmm, I thought most RISCy CPUs kept FP values in GP registers?
- monocasa 8y agoNo, I can't think of an arch that does that. Power, SH, Mips, Sparc, Alpha, ARM, and RISC-V all have separate architectural register files for the floating point state. Some ARM ABIs end up passing floats in integer registers, but that's just for compatibility for code that doesn't assume the presence of an FPU and might be doing everything soft float.
- cperciva 8y agoHmm, ok. It's a long time since I've looked at that. Come to think of it, I think it might be 20 years since I opened CA:QA...
- andreiw 8y agoYeah I’d say that modern OoO Arm implementations (A57, A72, ...) are worth trying to speculate into trapped VFP state. Lazy FPU is definitly a thing everywhere. My hunch says that chips affected by 4a could easily be fair game (4a is speculating reads into priviledged regs... I wonder if 4a would work on regs that are trapped, not inconceivable)