35 ms·
Zenbleed
- deleted 3y ago[deleted]
- dtx1 3y ago> AMD have released an microcode update for affected processors. Your BIOS or Operating System vendor may already have an update available that includes it. Yes, I love flashing BIOS... edit nvm, Microcode can get updated via system updates.
- Night_Thastus 3y agoTo be fair, flashing the bios isn't nearly as bad on most modern systems. Put the file on a USB drive, plug it in, restart and go into the bios, look for the flashing utility, select the file, done. As long as the machine is on a UPS in case of disaster, everything's accounted for.
- astrange 3y agoMine loses its settings when you update the BIOS, so your fan curves go away.
- dtx1 3y agoFrom my experience: Better have a > 32gig USB Flash drive, everything else doesn't work (MSI) and I don't have an UPS so it's always quite an exciting experience. Especially since Motherboard Manifactures save almost a whole dollar by not having a display ouputting anything. So it's blinkenlights and hope for the best
- Night_Thastus 3y agoGet a UPS!! Not just for convenience, but safety. You don't want to be caught out when something goes wrong, even without flashing the bios. A lot of boards these days have 7-segment displays. They're not great, but they're a good step up. Don't need to spend a lot, I think they show up on $300-ish boards. Mine definitely does.
- dtx1 3y agoI see no need for it. Living in Germany, any kind of power outages are exceptionally rare. I remember one in the last 10 years for a few hours and that was very local. If I am in a situation where a power outage occurs, i'll listen to my battery radio for a while and be fine. I work on nothing and rely on nothing that would actually require a UPS.
- Night_Thastus 3y agoIt's like not having a backup drive. Everything is fine until one day it isn't. A good UPS does more than just protect from outages. It also protects from surges and low-voltage situations that can both damage the equipment severely. A UPS doesn't cost much and will last many years. Buying a new motherboard and GPU because they got fried is much more expensive.
- namibj 3y agoKeep in mind that most equipment of this nature has universal power supplies, and thus works even at just 50% of nominal grid voltage. The substation is mandated to trip in that anomaly, btw. Otherwise some very common types of motors (AC induction, single and 3-phase) would burn from the excessive current they draw to compensate for the reduced voltage.
- baq 3y agoSometimes there's even a backup BIOS die available, so yeah, bricking is now much harder than in the past.
- yyyk 3y agoOften the BIOS will allow reading the update file from EFI partition, so there's no need for the USB drive.
- ls612 3y agoMy new computer takes a while to POST (z690 with ddr5 smh) so it’s basically been continuously either on or in sleep since I built it 18 months ago and I’ve had an unexpected shutdown due to power loss once in that time according to the Event log. I think the risk of losing power while flashing the bios is very small in real life unless you are stuck in a place with third world electricity infrastructure.
- formerly_proven 3y agoIf POST takes a long time it’s often memory training, backing off on the timings just slightly might make it go a lot quicker. Bios updates also often twiddle knobs in this area.
- Night_Thastus 3y agoDoesn't that only happen on the first boot with new memory? As well, I thought it was more of a concern on AMD, and less on Intel. (Z690 is Intel)
- themoonisachees 3y agoMemory training can happen if the CPU detects that current timings don't work at boot. Since GP never shuts down, it's possible that his memory is always hot and performs better on a reboot (when setting new timings) than after a cold boot (this is basically always true since ram chips like to be hot but especially relevant here). If GP is using XMP or has custom timings, I'd suggest easing off on them especially considering the novelty of DDR5.
- ls612 3y agoIt isn’t this, it takes about a minute to train after a bios update or when I enable XMP but never trains after that. It just takes like 20-30 seconds to get all the way to the bios splash screen and only 5 seconds to return from sleep so I just use sleep instead of turning it off. Then the only time I need to wait through a boot is for windows updates.
- deaddodo 3y agoMicrocode updates haven't been managed in-BIOS for over a decade now. If you use Linux, you'll usually see them released as some package like "intel-microcode" or "amd-microcode". Even EFI updates rarely are very intrusive or dangerous, and can also be handled by the Operating System via an update.
- mrpippy 3y agoThey are managed both ways. I think updating in BIOS is preferable to ensure no CPU parameters change while (some part) of the kernel has already initialized. But of course BIOS updates have many downsides and often stop after a few years.
- causi 3y agoAMD Ryzen 5000 Series Processors with Radeon Graphics Does this mean Ryzen CPUs without integrated graphics are fine?
- gruez 3y agoNo, it's all Zen 2 CPUs, which include both desktop CPUs (with or without integrated graphics, laptop CPUs, and server CPUs. The reason why the product list is so confusing is that AMD reuses architectures across generations. You'd think that all ryzen 5000 series CPUs have the same microarchitecture, but they don't). It's much easier to consult this list instead: https://en.wikipedia.org/wiki/Zen_2#Products https://en.wikipedia.org/wiki/Zen_2#Products
- paulmd 3y agoFYI this list isn't exhaustive. And I went to recommend the wikichips link and it's not exhaustive either. https://en.wikichip.org/wiki/amd/microarchitectures/zen_2#All_Zen_2_Chips https://en.wikichip.org/wiki/amd/microarchitectures/zen_2#Al... Both of them are missing the newer 7000-family products with Zen2 like 7520U etc. https://www.amd.com/en/products/apu/amd-ryzen-5-7520u https://www.amd.com/en/products/apu/amd-ryzen-5-7520u https://www.amd.com/en/products/apu/amd-ryzen-3-7320u https://www.amd.com/en/products/apu/amd-ryzen-3-7320u https://www.amd.com/en/products/apu/amd-athlon-gold-7220u https://www.amd.com/en/products/apu/amd-athlon-gold-7220u
- neogodless 3y agoThe 7520U and 7530U are listed on the linked Wikipedia page. Look under "Ultra-mobile APUs". The Athlon is missing, though.
- tremon 3y agoproducts/apu/amd-athlon Wait... now there's also APU's under the AMD Athlon brand? I know that people are happy when AMD's product offerings are on-par or outperforming Intel, but they didn't have to outdo Intel in the consumer confusion arena as well.
- lopkeny12ko 3y agoRelevant snippet: This technique is CVE-2023-20593 and it works on all Zen 2 class processors, which includes at least the following products: AMD Ryzen 3000 Series Processors AMD Ryzen PRO 3000 Series Processors AMD Ryzen Threadripper 3000 Series Processors AMD Ryzen 4000 Series Processors with Radeon Graphics AMD Ryzen PRO 4000 Series Processors AMD Ryzen 5000 Series Processors with Radeon Graphics AMD Ryzen 7020 Series Processors with Radeon Graphics AMD EPYC “Rome” Processors
- kevin_thibedeau 3y agoFYI, Ryzen 3000 APUs aren't Zen 2.
- neogodless 3y ago> AMD Ryzen 3000 Series Processors The above are desktop. If they meant APUs, it would list "Ryzen 3000 Series Processors with Radeon Graphics."
- timw4mail 3y agoThey are Zen+, aren't they?
- tremon 3y agoDo they mean "only confirmed on Zen2", or is the problem definitely confined to only this architecture? Is it likely that this same technique (or similar) also works on earlier (Zen/Zen+) or later (Zen3) cores, but they just haven't been able to demonstrate it yet?
- paulmd 3y agoIt's Tavis Ormandy, and he reported it to AMD, so one would assume they tried it on related hardware and it's not working.
- rincebrain 3y agoAt least the stock exploit code he provided said "nope I can't get shit to leak" on my 5900X.
- mrpippy 3y agoIt feels like not-a-coincidence that OpenBSD added AMD microcode loading in the last 3 days. https://news.ycombinator.com/item?id=36838511 https://news.ycombinator.com/item?id=36838511
- hammock 3y agoExplain that like I’m 5?
- laverya 3y agoThe patch for this exploit is to load AMD's updated microcode.
- dumdumchan 3y agoIs apt update && apt upgrade enough for pop-os users?
- CameronNemo 3y agoProbably eventually yes, but if you are really concerned you need to discuss it with your distro maintainers.
- gabereiser 3y agoThis. Not everyone is as quick as say Arch or Fedora in updating/patching. Please reach out to your maintainers of the distro you use.
- deleted 3y ago[deleted]
- vladvasiliu 3y agoEven Arch seems out of date as of 24 jul 2023 17:55 UTC. The latest amd firmware version is 20230625.
- sounds 3y agoThe site is getting hugged to death. https://web.archive.org/web/20230724143835/https://lock.cmpxchg8b.com/zenbleed.html https://web.archive.org/web/20230724143835/https://lock.cmpx...
- AdmiralAsshat 3y agoAnd now we've hugged the archive to death. Nice job!
- loeg 3y agoThe original still loads (eventually) for me. YMMV.
- ksec 3y agoIt is a simple static HTML page, how is it possible in 2023 a static site could be hugged to death. In most cases HN traffic barely hits 100 page view per second.
- jedberg 3y agoIt's a security writeup so it's probably run by a security expert who is not an expert at running high traffic websites. Most likely there is something on the page that causes a database hit. Possibly the page content itself.
- deleted 3y ago[deleted]
- Shazshe 3y ago[flagged]
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- HideousKojima 3y ago[flagged]
- ItsTotallyOn 3y agoWhat does this allow the attacker to do? Steal data? The post isnt very clear.
- sounds 3y agoHuh. The very first line seems pretty clear: > If you remove the first word from the string "hello world", what should > the result be? This is the story of how we discovered that the answer > could be your root password! Can you please expand on your question?
- bananapub 3y agoI assume they meant "what does this do in normal vulnerability discussion terms", I don't know why tavis didn't just say "arbitrary memory read across processes" or whatever.
- ItsTotallyOn 3y agodoes it require physical access to the machine?
- hprotagonist 3y agoah, not the color theme. Hamming distance strikes again! https://kippura.org/zenburnpage https://kippura.org/zenburnpage
- heywhatupboys 3y agoI knew there were color schemes for the color blind. Schemes for the blind are news to me though
- 0xbadcafebee 3y agoThis is super cool. This exploit will be one of the canonical examples that just running something in a VM does not mean it's safe. We've always known about VM breakout, but this is a no-breakout massive exploit that is simple to execute and gives big payoffs. Remember: just because this one bug gets fixed in microcode doesn't mean there's not another one of these waiting to be discovered. Many (most?) 0-days are known about by black-hats-for-hire well before they're made public. CPU vulnerabilities found in the past few years: https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability) https://en.wikipedia.org/wiki/Spectre_(security_vulnerability) https://aepicleak.com/ https://en.wikipedia.org/wiki/Software_Guard_Extensions#SGAxe https://en.wikipedia.org/wiki/Software_Guard_Extensions#LVI https://en.wikipedia.org/wiki/Software_Guard_Extensions#Plundervolt https://en.wikipedia.org/wiki/Software_Guard_Extensions#MicroScope_replay_attack https://en.wikipedia.org/wiki/Software_Guard_Extensions#Enclave_attack https://en.wikipedia.org/wiki/Software_Guard_Extensions#Prime+Probe_attack https://www.vusec.net/projects/crosstalk/ https://en.wikipedia.org/wiki/Hertzbleed https://www.securityweek.com/amd-processors-expose-sensitive-data-new-squip-attack/
- cmrdporcupine 3y agoIn the end, I'm thinking most of these are related to branch prediction? It strikes me that it's either that branch prediction is so inherently complex enough it's always going to be vulnerable to this and/or it just so defies the way most of us intuitively think about code paths / instruction execution that it's hard to conceive of the edge cases until too late? At what point does the complexity of CPU architectures become so difficult to reason about that we just accept the performance penalty of keeping it simpler?
- c7DJTLrn 3y agoWe demanded more performance and we got what we demanded. I doubt manufacturers are going to walk back on branch prediction no matter how flawed it is. They'll add some more mitigations and features which will be broken-on-arrival.
- 3y ago
- ComputerGuru 3y agoNo details on the performance impact of the microcode update. Presumably it disables speculative execution of vzeroupper?
- hinkley 3y agoOr adds a guard. They mention perf issues for the workaround but they're notably absent from the microcode commentary. I wonder what this is going to do to the new AMD hardware AWS is trying to roll out, which is supposed to be a substantial performance bump over the previous generation.
- infinityio 3y agoIt looks like this is a Zen 2-only exploit, so it shouldn't have any impact - AWS are likely already running hardware that isn't vulnerable to this
- hinkley 3y agoThe way Spectre and Meltdown played out, you'll have to excuse me if I stand outside the blast radius while we figure out if there's a chapter 2, 3 or 4 to this story. They've proven Zen 2 has this problem. They haven't proven no other AMD processors have it. A bunch of people looking to make names for themselves are probably busily testing every other AMD processor for a similar exploit.
- heywhatupboys 3y ago> The way Spectre and Meltdown played out, you'll have to excuse me if I stand outside the blast radius while we figure out if there's a chapter 2, 3 or 4 to this story. I am OOTL on this one, do you have some information you could share?
- loeg 3y agoThere has been a long trickle of similar bugs to Spectre/Meltdown coming out long after the initial bugs and "fixes" were published. (The early fixes were all, in some sense, incomplete.)
- wzdd 3y agoReally lovely writeup. I liked the discussion of determining how can you tell if a randomly-generated program performed correctly. The obvious approach is to just run it on an "oracle" -- another processor or simulator -- and see if it behaves the same way. But if you're checking for microarchitectural effects with tight timing windows you can also write the same program with various stalls, fences, nops and so on -- things which shouldn't affect the output (for single-threaded code) but which will result in the CPU doing significantly different things microarchitecturally. That way the CPU can be its own oracle.
- weinzierl 3y agoThis part was super interesting, especially the differences between fuzzing software and hardware. I also liked the chicken bit.
- eric__cartman 3y agoThis is incredibly scary. On my Zen 2 box (Ryzen 3600) logging the output of the exploit running as an unprivileged user while copying and pasting a string into a text editor in the background (I used Kate), resulted in pieces of the string being logged into the output of zenbleed. And this is after a few seconds of runtime mind you, not even a full minute. Thankfully the exploit is highly dependent on a specific asm routine so exploiting it from JS or WASM in a browser should be extremely difficult. Otherwise a nefarious tab left open for hours in the background could exfiltrate without an issue. I'm eagerly waiting for Fedora maintainers to push the new microcode so the kernel can update it during the boot process.
- loeg 3y ago> Thankfully the exploit is highly dependent on a specific asm routine so exploiting it from JS or WASM in a browser should be extremely difficult. Otherwise a nefarious tab left open for hours in the background could exfiltrate without an issue. At least one commentor here claims to be able to reproduce this with javascript: https://news.ycombinator.com/item?id=36849767 https://news.ycombinator.com/item?id=36849767 .
- IshKebab 3y agoA very bold claim with zero evidence.
- zekica 3y ago
- darkclouds 3y agoNice catch! > If you can’t apply the update for some reason, there is a software workaround: you can set the chicken bit DE_CFG[9]. It reminds me of the compiler switches which can alter the way code at different levels (global, procedure, routine) can access variables declared at different levels and the change in scope that ensues. Maybe some of this HW caching should be left to the coders.
- artisanspam 3y agoWhy does disabling SMT not fully prevent this? I don't know the details of Zen 2 architecture, but register files are usually implemented as SRAM on the CPU-die itself. So unless the core is running SMT, I don't understand how another thread could be accessing the register file to write a secret.
- wbl 3y agoBecause the context switch only affects architectural state not microarchitectural state.
- artisanspam 3y agoYes I understand that but I was struggling to think of a sequence of instructions that would cause this secret leaking on a single thread. But a simple example is `vzeroupper` followed by anything that writes a secret to the same register file entry would be leaked on a subsequent flush.
- wbl 3y agoThat's not quite right. The attacker doss the vzeroupper rollback. Any registers in the physical file that haven't been overwritten can be exposed as a result, regardless of what the victim did.
- crote 3y agoIt depends a bit on the exact details of the implementation, but there are several possibilities imaginable. For example, a failed speculation of vzeroupper could result in it erroneously claiming a register by clearing the zero flag on the wrong register - which would mean that the previous data of that register is now suddenly available. If that register has not been touched since a context switch, it could leak data from another process. The linked article has an animation which suggests that it clears the zero flag on the previously-used register - which indeed requires the victim to reuse the register in the small amount of time between it being marked as zero and the zero being cleared again. However, the linked Github repo states: > The undefined portion of our ymm register will contain random data from the register file. [..] Note that this is not a timing attack or a side channel, the full values can simply be read as fast as you can access them. This suggests that it does indeed do something akin to clearing the zero flag of a random register.
- jrmg 3y agoAMD have released an microcode update for affected processors. Your BIOS or Operating System vendor may already have an update available that includes it. I don’t really understand how CPU microcode updates work. If I’m keeping Ubuntu up to date, will this just happen automatically?
- naikrovek 3y agono. microcode changes are provided to the CPU at boot time and are only valid early in the boot process. the machine UEFI/BIOS must apply them.
- tremon 3y agoLinux can (and does) apply microcode patches during kernel boot.
- kzrdude 3y agofor example use journalctl -k -g microcode to see log messages related to this: (intel cpu, so revision does not relate to anything AMD) > microcode: microcode updated early to revision 0xa6, date = 2022-06-28
- naikrovek 3y agooh. every time I think I'm right, I'm wrong, and every time I think I'm wrong, I'm right. except here. I'm always wrong, here.
- tremon 3y agoIf you already have the package amd64-microcode installed (highly likely), then yes it will be updated automatically. https://packages.ubuntu.com/search?keywords=amd64-microcode https://packages.ubuntu.com/search?keywords=amd64-microcode
- jrmg 3y agoGreat, thanks. Sort of weirds me out that my OS can just silently update my CPU - I didn’t realize I was giving it that level of control… I guess it’s good vs the alternative of no-one actually updating for exploits like his though.
- cratermoon 3y agoThis link seems hugged to death, so here's an alternate source: AMD 'Zenbleed' Bug Allows Data Theft From Zen 2 Processors, Patches Coming: <https://www.tomshardware.com/news/zenbleed-bug-allows-data-theft-from-amds-zen-2-processors-patches-released https://www.tomshardware.com/news/zenbleed-bug-allows-data-t...>
- ItsTotallyOn 3y agoThis story has comments from AMD, too.
- codedokode 3y agoI don't understand how a microcode update could fix this. I assume microcode is used for slow operations like triginometric functions, and doesn't affect how registers are allocated or renamed. Or does the update simply disables some optimizations using "chicken bits"? And by the way, is there a list of such bits?
- sebzim4500 3y agoEverything a modern CPU runs is microcode. There are a few x86 instructions that translate to a single microcode instruction, but most are translated to several.
- wolf550e 3y agoThe designers leave themselves an ability to override any instruction using the microcode so they can patch any instruction. They don't use the microcode only to implement complex instructions that require loops.
- kristjank 3y agoAt least it's fixed in microcode, unlike some recent exploits (Spectre and Meltdown come to mind)
- gavinhoward 3y agoOff-topic question, but can some experts tell me why it is safe for `strlen()` and friends to use vector instructions when they can technically read out of bounds?
- loeg 3y agoEssentially because memory mappings and RAM work at page granularity, rather than bytes. If a read from in-bounds in a page isn't going to fault, a read later in the same page isn't going to fault either (even if it is past the end of the particular object). You can see this in glibc's implementation, which checks for crossing page boundaries: https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/x86_64/multiarch/strlen-avx2.S;h=ef47a45cb6289ef9a7ff076521006ca5990c4180;hb=HEAD#l68 https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/x86... (line ~68)
- gavinhoward 3y agoAh, so that's why there is special code in Valgrind to handle glibc and friends!
- loeg 3y agoI think capability-pointer machines like CHERI might need in-bounds-only variants of these functions, too.
- saagarjha 3y agoGenerally CHERI tracks things for 16-byte regions
- Liquid_Fire 3y agoI think you might be confusing the tracking of validity of capabilities themselves (which could indeed be at a 16 byte granularity for an otherwise 64-bit system) with the bounds of a capability, which can be as small as 1 byte.
- nemetroid 3y agoThe README in the tar file with the exploit (linked at "If you want to test the exploit, the code is available here") contains some more details, including a timeline: - `2023-05-09` A component of our CPU validation pipeline generates an anomalous result. - `2023-05-12` We successfully isolate and reproduce the issue. Investigation continues. - `2023-05-14` We are now aware of the scope and severity of the issue. - `2023-05-15` We draft a brief status report and share our findings with AMD PSIRT. - `2023-05-17` AMD acknowledge our report and confirm they can reproduce the issue. - `2023-05-17` We complete development of a reliable PoC and share it with AMD. - `2023-05-19` We begin to notify major kernel and hypervisor vendors. - `2023-05-23` We receive a beta microcode update for Rome from AMD. - `2023-05-24` We confirm the update fixes the issue and notify AMD. - `2023-05-30` AMD inform us they have sent a SN (security notice) to partners. - `2023-06-12` Meeting with AMD to discuss status and details. - `2023-07-20` AMD unexpectedly publish patches, earlier than an agreed embargo date. - `2023-07-21` As the fix is now public, we propose privately notifying major distributions that they should begin preparing updated firmware packages. - `2023-07-24` Public disclosure.
- sedatk 3y ago> AMD unexpectedly publish patches, earlier than an agreed embargo date. > As the fix is now public, we propose privately notifying major distributions that they should begin preparing updated firmware packages. AMD had to drop the ball somewhere didn't it.
- klyrs 3y agoIt's good that they published patches early, isn't it?
- robryk 3y agoYou'd want the delay between first publication of X and the microcode update making its way into releases of OSes to be smallest, for various values of X (mention of a vulnerability, microcode patch, description of vulnerability, PoC). Making various OS releasers aware that a microcode patch that fixes a vulnerability will be published on a given date before that date decreases that for most values of X.
- sedatk 3y agoI didn't expect it to as it's Zen3, but still tried: doesn't repro on my 5950X.
- href 3y agoCan anyone explain the `wrmsr -a 0xc0011029 $(($(rdmsr -c 0xc0011029) | (1<<9)))`? It seems to help on my system, but I don't understand what it does, and I don't know how to unset it.
- mmastrac 3y agoThis sets the chicken bit: https://www.phoronix.com/news/Linux-AMD-Spectral-Chicken https://www.phoronix.com/news/Linux-AMD-Spectral-Chicken
- taviso 3y agoAn msr is a "model specific register", a chicken bit can configure cpu features. They don't persist across a reboot, so you can't break anything. You can undo what you just did without a reboot, just use `... & ~(1 << 9)` instead (unset the bit instead of set it).
- mike_hearn 3y agoCPU designers know that some features are risky. Much like how web apps may often have "feature flags" that can be flipped on and off by operators in case a feature goes wrong, CPUs have "chicken bits" that control various performance enhancing tricks and exotic instructions. By flipping that bit you disable the optimization.
- dTP90pN 3y ago> AMD have released an microcode update for affected processors. I don't think that is correct. AMD has released a microcode update[0] for family 17h models 0x31 and 0xa0, which corresponds to Rome, Castle Peak and Mendocino as per WikiChip [1]. So far, there seems to be no microcode update for Renoir, Grey Hawk, Lucienne, Matisse and Van Gogh. Fortunately, the newly released kernels can and do simply set the chicken bit for those. [2] [0] https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=0bc3126c9cfa0b8c761483215c25382f831a7c6f https://git.kernel.org/pub/scm/linux/kernel/git/firmware/lin... [1] https://en.wikichip.org/wiki/amd/cpuid#Family_23_.2817h.29 https://en.wikichip.org/wiki/amd/cpuid#Family_23_.2817h.29 [2] https://github.com/torvalds/linux/commit/522b1d69219d8f083173819fde04f994aa051a98 https://github.com/torvalds/linux/commit/522b1d69219d8f08317...
- dTP90pN 3y agoMore details: `good_revs` as per the kernel: https://github.com/torvalds/linux/commit/522b1d69219d8f083173819fde04f994aa051a98#diff-de2b53cae08d8bbbea0a1d691be722a7bbfec5cb32b20f5fbf13949b75fecc5fR990-R995 https://github.com/torvalds/linux/commit/522b1d69219d8f08317... Currently published revs ("Patch") (git HEAD): https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/amd-ucode/README https://git.kernel.org/pub/scm/linux/kernel/git/firmware/lin... As of this writing, only two of the five `good_rev`s have been published.
- userbinator 3y agoand Mendocino That's the same codename Intel used for Celerons 24 years ago, the ones famous for 50% overclocks: https://ark.intel.com/content/www/us/en/ark/products/codename/26586/products-formerly-mendocino.html https://ark.intel.com/content/www/us/en/ark/products/codenam...
- LtdJorge 3y agoThis is both as cool as it is scary. I managed to "exfiltrate" pieces of my Bitwarden password (could easily be reconstructed), ssh login password, and bank credentials in a minute of running from a 10MB sample.
- akyuu 3y agohttps://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html https://www.amd.com/en/resources/product-security/bulletin/a... According to AMD's security bulletin, firmware updates for non-EPYC CPUs won't be released until the end of the year. What should users do until then, disable the chicken bit and take the performance hit?
- stefan_ 3y agoAre they out of their mind? This is not a "medium".
- qhwudbebd 3y agoPresumably classified as severity 'medium' in an attempt to look marginally less negligent when announcing that they can't be bothered to issue microcode updates for most CPU models until Nov or Dec.
- themoonisachees 3y agoUnder what circumstances is this not a medium? The only case this applies is if you have public runners running completely untrusted code, and if you're doing that I hope you're doing it on EPYC, which is fixed. And if you're doing that, you're probably mining crypto for randoms.
- akyuu 3y agoWhat about running JavaScript on a browser?
- themoonisachees 3y agoI am very doubtful that there exists any JavaScript that compiles to the specific instructions needed for this exploit.
- akyuu 3y ago
- blinkingled 3y agoOn my Zen2 / Renoir based system the PoC exploit continues to work albeit slowly even after updating the microcode (linked from TFA) that has the fix for this issue. The wrmsr stops it fully in its track. Edit: just realized it must have been that the initramfs image is not updated with the manually updated firmware in /lib/firmware. Edit2: Updated the initramfs and even if the benchmark.sh fails, ./zenbleed -v2 still picks out and prints strings which doesn't happen with the wrmsr solution.
- johnp_ 3y agolinux-firmware does not carry any microcode update for Renoir (yet). Or what do you mean by "TFA"? The fixed Renoir microcode should have revision >= 0x0860010b as per the kernel: https://github.com/torvalds/linux/commit/522b1d69219d8f083173819fde04f994aa051a98#diff-de2b53cae08d8bbbea0a1d691be722a7bbfec5cb32b20f5fbf13949b75fecc5fR991-R995 https://github.com/torvalds/linux/commit/522b1d69219d8f08317...
- blinkingled 3y agoTFA == The Fine Article :) Updated microcode shows 0x08600106 revision so I guess that explains it.
- deleted 3y ago[deleted]
- farhanhubble 3y agoWhat a beautiful article! All my memories from the computer architecture class came rushing back.
- rodgerd 3y agoIt's worth noting that the FSF consider that supporting microcode updates makes software "un-free". This is a great example of what an inordinately stupid and harmful position that is.
- boomboomsubban 3y agoThe FSF would have no issues with this if the microcode was free software. I don't necessarily agree with the FSF position on microcode, but they aren't against the idea of updating microcode.
- SamuelAdams 3y agoTo me this is the buried lede: > It was challenging to get the details right, but I used this to teach my fuzzer to find interesting instruction sequences. This allowed me to discover features like merge optimization automatically, without any input from me! What happens when AI can start fuzzing software? Seems like a golden opportunity for opsec folks.
- slappy7 3y agoAnybody know how to disable the chicken bit on Windows? They're not planning to fix this until fucking December...
- attentive 3y agoThat's atrocious. Looks like microsoft doesn't care about AMD CPU as much as AMD doesn't care about windows. As far as I can see there is no easy way to use MSR on windows.
- attentive 3y agoI may be missing something, but since it basically exploits AVX that is easy to disable in win10. bcdedit /set xsavedisable 1 and then reboot. At least it fails the zenbleed POC.
- JDW1023 3y agoIt seems like there's an wrmsr (write MSR) tool for Windows [0]. I don't know whether it will work the same way as the linux verison. [0]: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/wrmsr--write-msr- https://learn.microsoft.com/en-us/windows-hardware/drivers/d...
- _8j50 3y agoNice writeup, very easy to read. This guy is a bonafide legend, the whole time, based on his writing style I thought it was someone new to the field explaining in detail because it was hard for him to get it as well, but I see his name at the end and recalled all the epic findings of his. Very humble/nice guy, even in person I hear (rare for well accomplished people in tech). One thing I don't get though, if amd64 is affected, shouldn't the complementary instructions in X64/intel also be affected? Does intel move around RAT referenced values instead of just setting/unsetting the z-bit?
- raymond_goo 3y agoSummary of the blog post "Zenbleed" by Tavis Ormandy: The blog post discusses the discovery of a vulnerability called "Zenbleed" in certain AMD Zen 2 processors. It revolves around the use of AVX2 and the vzeroupper instruction, which zeroes upper bits in vector registers (YMM) to avoid dependencies and stalls during superscalar execution. The vulnerability arises from a misprediction involving vzeroupper, which can be exploited with precise scheduling and triggering the XMM Register Merge Optimization, leading to a use-after-free-like situation. This allows attackers to monitor operations using vector registers, potentially leaking sensitive information like encryption keys and passwords. The author found the bug through fuzzing and developed a new approach called Oracle Serialization to detect CPU execution errors during testing. The vulnerability (CVE-2023-20593) affects various AMD Zen 2 processors, but AMD released a microcode update to address the issue. For systems unable to apply the update, a software workaround exists by setting the DE_CFG[9] "chicken bit." The post concludes with acknowledgments to individuals who contributed to the discovery and analysis of the Zenbleed vulnerability.
- pythonist42 3y agoYou mean I will have to change my processor???
- BoryAlis 3y ago[flagged]
- xinayder 3y agoI read the article and I really liked that the author tried to make it seem as simple as possible that you don't need a degree or a deep understanding of how CPUs work to understand the issue. However, one thing that bothers me is that the author claims it's possible to retrieve private keys or root passwords by triggering a faulty revert from the instruction that resets the upper bits of a register. Where is the demo results? All I see is a small-enough gif that looks like the Matrix terminal text scrolling through. Is there any way (other than running the exploit program myself) to check the results and see that it actually leaked the root password and other information?
- ZeKK14 3y agoThe exploit will leak more or less random data (data which was accessed recently by the CPU). You cannot target a specific part of the memory, but you can keep fetching data until you get something interesting.
- eric__cartman 3y agoThe only way would be to let the thing run and say, pipe the output to grep looking for your password or something else you're looking for. SIMD instructions are used very often for parsing text so I wouldn't be surprised if sensitive passwords eventually get loaded into an YMM register and the exploit just so happened to dump that.
- bfrog 3y agoVMs were and always have been a sort of faked out security blanket. The reality is there's shared hardware, shared memory, shared network interfaces, shared storage. That and these days you can run so much on a single machine its really hard to understand the thinking that colo isn't and wasn't the best option. AWS isn't some mythical devops dream that never fails. It's a highly convoluted (in price as well as function) affair.
- carapace 3y agoEvery time I think it's insane to contemplate making one's own chips something like this comes up, and I realize it's insane to let so much of our lives depend on these insanely complicated devices. It feels like walking on a tightrope above an unbounded fractal chasm.