5 ms·

The Pentium F00F Bug (1998)

54 points by unilynx 5y ago

F00Fbug 5y ago
You rang?
re 5y ago
(1998)
- klik99 5y ago
  I mean, pentium is in the blog title, so kind of expected that
  - meepmorp 5y ago
    Intel still sells chips under the Pentium brand, with releases as recent as 1Q21
    - qwerty456127 5y ago
      Do they still have the bug?
      - meepmorp 5y ago
        Only if you buy the retro line
vardump 5y ago
"Suppose you download an ActiveX applet that contains this code. As soon as the code executes, your computer freezes up." So much simpler times... completely unthinkable nowadays.
- garmaine 5y ago
  I'm not sure if this is sarcasm? It's maybe a little bit more difficult, but certainly possible today. Nothing fundamentally has changed since then.
  - arghwhat 5y ago
    It is indeed not only possible, the amount of untrusted code that people run is several orders of magnitude larger now than it was back then. And no, the web browser is no guardian of yours. Attacks like ROWHAMMER work just fine from within JavaScript.
  - klik99 5y ago
    Surely it's not possible to run untrusted arbitrary straight on the metal assembly from the browser? Or if so, the only via JS VM exploits that could be patched via browser updates, right? Not having the ability to exploit machine metal level exploits via browser in a way that can't be patched via security updates seems like progress, even though it it's progress with a lot of caveats. If I'm wrong, I'm reinstalling all my noscript extensions... Of course, as a non-security guy, I'm still shocked that signed windows binaries can load unsigned dlls without any warnings - at least os x has some checks around this - so maybe I'm just naive
    - garmaine 5y ago
      You don't need to run straight on the metal assembly to exploit processor bugs. In this particular case of the Pentium F00F bug, I admit it seems difficult to tease a JIT compiler to generate such an instruction as it is not in fact a legal x86 instruction according to the ISA. I wouldn't be confident in saying it is impossible though. I've seen weirder things done. But speaking generally as I meant to in my earlier comment, nearly all privilege-escalating processor bugs which have followed have been remote exploitable via the browser's JavaScript JIT compiler. A quick google will get you prototype research implementations of Rowhammer, Spectre, and Meltdown which can be served for execution as script on a webpage and extract information from vulnerable clients.
      - 5y ago
- orbital-decay 5y ago
  Just like a random piece of JS siphoning arbitrary memory values through a side channel in vulnerable CPUs. Wait...
  - api 5y ago
    Yes, but that's much harder to exploit in practice than these kinds of bugs.
- api 5y ago
  I actually found an Intel Ice Lake bug (on a MacBook Air) like this, but unfortunately I could not claim a bounty since I wasn't the first. A number of people found it independently. https://bugs.openjdk.java.net/browse/JDK-8248315 https://bugs.openjdk.java.net/browse/JDK-8248315 I don't think anyone found a way to trigger it via JavaScript but it was easy to reproduce for some reason via the JVM. AFAIK Intel never released exactly what it was, just a microcode update. X64 has a horrifically complex legacy encoding and tons of extensions including many that are obsolete but still supported. It really lends itself to these kinds of bugs. Every mature architecture including ARM/ARM64 has cruft, but X86/X64 is particularly bad.
  - pbsd 5y ago
    That might have been ICL065 [1], whose fix was disabling register move elimination at the renaming stage. The timing matches. [1] https://cdrdv2.intel.com/v1/dl/getContent/341079 https://cdrdv2.intel.com/v1/dl/getContent/341079
- qwerty456127 5y ago
  Downloading something that makes your computer freeze up is not unthinkable today. Occasionally someone would post (here on HN) a link to a huge PDF on GitHub. As soon as I click it in Chrome on Linux (Windows doesn't seem vulnerable to this) the computer becomes so slow it's not even possible to close Chrome any more. And AFAIK I'm not alone: I already mentioned this here in the past and people confirmed.
- tiagod 5y ago
  Plenty of remote execution bugs found every year in major software that could lead to much bigger problems. Sure, this could lock up your computer, but the ActiveX program itself could actually send data out, just like what can be (and is frequently) done with RCE bugs.
- anthk 5y ago
  Back in the day, <img src="c:\con\con">Heh<img> was enough to crash the whole w9x machine.
CaliforniaKarl 5y ago
https://web.archive.org/web/20210426205731/http://www.rcollins.org/ddj/May98/F00FBug.html https://web.archive.org/web/20210426205731/http://www.rcolli...
deleted 5y ago
[deleted]
rlv-dan 5y ago
I remember getting a new version of (now classic) NES emulator Nesticle and finding a new menu option simply called "Pentium bug". Of course I had to try it out. Nothing happened. Literary nothing, because my whole system had of course freezed up...
BruceEel 5y ago
Memorable one. I miss Collins' x86 articles.
dang 5y ago
One past thread: The Pentium F00F Bug (1998) - https://news.ycombinator.com/item?id=16026933 https://news.ycombinator.com/item?id=16026933 - Dec 2017 (8 comments)

54 points by unilynx 5y ago

F00Fbug 5y ago

You rang?

re 5y ago

(1998)

klik99 5y ago
I mean, pentium is in the blog title, so kind of expected that
- meepmorp 5y ago
  Intel still sells chips under the Pentium brand, with releases as recent as 1Q21
  - qwerty456127 5y ago
    Do they still have the bug?
    - meepmorp 5y ago
      Only if you buy the retro line

vardump 5y ago

"Suppose you download an ActiveX applet that contains this code. As soon as the code executes, your computer freezes up." So much simpler times... completely unthinkable nowadays.

garmaine 5y ago
I'm not sure if this is sarcasm? It's maybe a little bit more difficult, but certainly possible today. Nothing fundamentally has changed since then.
- arghwhat 5y ago
  It is indeed not only possible, the amount of untrusted code that people run is several orders of magnitude larger now than it was back then. And no, the web browser is no guardian of yours. Attacks like ROWHAMMER work just fine from within JavaScript.
- klik99 5y ago
  Surely it's not possible to run untrusted arbitrary straight on the metal assembly from the browser? Or if so, the only via JS VM exploits that could be patched via browser updates, right? Not having the ability to exploit machine metal level exploits via browser in a way that can't be patched via security updates seems like progress, even though it it's progress with a lot of caveats. If I'm wrong, I'm reinstalling all my noscript extensions... Of course, as a non-security guy, I'm still shocked that signed windows binaries can load unsigned dlls without any warnings - at least os x has some checks around this - so maybe I'm just naive
  - garmaine 5y ago
    You don't need to run straight on the metal assembly to exploit processor bugs. In this particular case of the Pentium F00F bug, I admit it seems difficult to tease a JIT compiler to generate such an instruction as it is not in fact a legal x86 instruction according to the ISA. I wouldn't be confident in saying it is impossible though. I've seen weirder things done. But speaking generally as I meant to in my earlier comment, nearly all privilege-escalating processor bugs which have followed have been remote exploitable via the browser's JavaScript JIT compiler. A quick google will get you prototype research implementations of Rowhammer, Spectre, and Meltdown which can be served for execution as script on a webpage and extract information from vulnerable clients.
    - 5y ago
orbital-decay 5y ago
Just like a random piece of JS siphoning arbitrary memory values through a side channel in vulnerable CPUs. Wait...
- api 5y ago
  Yes, but that's much harder to exploit in practice than these kinds of bugs.
api 5y ago
I actually found an Intel Ice Lake bug (on a MacBook Air) like this, but unfortunately I could not claim a bounty since I wasn't the first. A number of people found it independently. https://bugs.openjdk.java.net/browse/JDK-8248315 https://bugs.openjdk.java.net/browse/JDK-8248315 I don't think anyone found a way to trigger it via JavaScript but it was easy to reproduce for some reason via the JVM. AFAIK Intel never released exactly what it was, just a microcode update. X64 has a horrifically complex legacy encoding and tons of extensions including many that are obsolete but still supported. It really lends itself to these kinds of bugs. Every mature architecture including ARM/ARM64 has cruft, but X86/X64 is particularly bad.
- pbsd 5y ago
  That might have been ICL065 [1], whose fix was disabling register move elimination at the renaming stage. The timing matches. [1] https://cdrdv2.intel.com/v1/dl/getContent/341079 https://cdrdv2.intel.com/v1/dl/getContent/341079
qwerty456127 5y ago
Downloading something that makes your computer freeze up is not unthinkable today. Occasionally someone would post (here on HN) a link to a huge PDF on GitHub. As soon as I click it in Chrome on Linux (Windows doesn't seem vulnerable to this) the computer becomes so slow it's not even possible to close Chrome any more. And AFAIK I'm not alone: I already mentioned this here in the past and people confirmed.
tiagod 5y ago
Plenty of remote execution bugs found every year in major software that could lead to much bigger problems. Sure, this could lock up your computer, but the ActiveX program itself could actually send data out, just like what can be (and is frequently) done with RCE bugs.
anthk 5y ago
Back in the day, <img src="c:\con\con">Heh<img> was enough to crash the whole w9x machine.

CaliforniaKarl 5y ago

https://web.archive.org/web/20210426205731/http://www.rcollins.org/ddj/May98/F00FBug.html https://web.archive.org/web/20210426205731/http://www.rcolli...

deleted 5y ago

[deleted]

rlv-dan 5y ago

I remember getting a new version of (now classic) NES emulator Nesticle and finding a new menu option simply called "Pentium bug". Of course I had to try it out. Nothing happened. Literary nothing, because my whole system had of course freezed up...

BruceEel 5y ago

Memorable one. I miss Collins' x86 articles.

dang 5y ago

One past thread: The Pentium F00F Bug (1998) - https://news.ycombinator.com/item?id=16026933 https://news.ycombinator.com/item?id=16026933 - Dec 2017 (8 comments)