6 ms·
> Speculative execution is not fixed in modern CPUs? Very generally speaking, not really. It's a huge class and the pace of discovery of new vectors has contin
by wahern 3y ago
> Speculative execution is not fixed in modern CPUs?
Very generally speaking, not really. It's a huge class and the pace of discovery of new vectors has continued nearly unabated since Spectre. See https://en.wikipedia.org/wiki/Transient_execution_CPU_vulnerability https://en.wikipedia.org/wiki/Transient_execution_CPU_vulner... The effectiveness and cost of various remediations--software, microcode, hardware--varies depending on the particular vector, so some vectors can be considered fixed, while other vectors, such as some of those relating to SMT, might never be fully fixed without effectively giving up some of the benefits of SMT.
Some of the more robust theoretical remedies, like cache coloring and kernel scheduler-based process affinity schemes, still haven't seen much investment or attention, so I would expect the state of things to remain relatively crappy. It just may seem less crappy because the industry has become inured to the threat, and also perhaps because there's usually much lower hanging fruit for attackers (i.e. traditional exploits like with io_uring), so these vectors are rarely used in the wild.
- sylware 3y agoOk, then it means modern CPUs which are sold are not fixed. Weird, I was told Zen3 is fixed.
- rfoo 3y agoSpectre marks the beginning of a new bug class. It's more like "to write secure program on processors with speculative execution you must not do A, B and C". New processors fixed known bugs in the implementation of the silicon itself, but some of them can only be fixed in software. See https://leaky.page https://leaky.page
- sylware 3y agoI use only noscript/basic (x)html browsers. I heard from Zen3 silicon, spectre and friends are fixed.
- rfoo 3y agoSpectre as a general vulnerability class is NOT fixed. And you can write perfectly vulnerable-to-Spectre code in Rust, or anything you like. As long as there are "virtual" privilege separations under the same hardware privilege level, which is extremely common nowadays (hey, it's called sandbox). It would be vulnerable on ANY processor with speculative execution, including past, current and future Intel, AMD processors, M1, M2 and you name it. No need for JavaScript in browsers. Please just read the page, it's not browser specific. In this case the only thing one can fix is, surprise, the vulnerable code!