11 ms·
What does this allow the attacker to do? Steal data? The post isnt very clear.
by ItsTotallyOn 3y ago
What does this allow the attacker to do? Steal data? The post isnt very clear.
- sounds 3y agoHuh. The very first line seems pretty clear: > If you remove the first word from the string "hello world", what should > the result be? This is the story of how we discovered that the answer > could be your root password! Can you please expand on your question?
- bananapub 3y agoI assume they meant "what does this do in normal vulnerability discussion terms", I don't know why tavis didn't just say "arbitrary memory read across processes" or whatever.
- ItsTotallyOn 3y agodoes it require physical access to the machine?
- xmodem 3y agoNo, only the ability to execute arbitrary code in an unprivileged context. Would probably have to be arbitrary x86_64 instructions - Javascript wouldn't cut it for this one.
- sounds 3y agoI was able to reproduce the vulnerability using javascript on a webpage. Therefore, no.
- _flux 3y agoWhat javascript was that, or did you create your own? I did not find any from this post.
- crtasm 3y agoMight you post a screen recording?
- CyberDildonics 3y agoMight you explain how that would prove anything?
- heywhatupboys 3y agoeffort to lie on a text comment << effort to lie with a video
- evandale 3y agoWe are on a tech site with highly intelligent individuals who have been programming computers since we've been in diapers. If you don't believe the text then how would you believe the video? Anything can be done in devtools beforehand and I can think of a million different ways to fake the video. Personally, if I didn't trust the text then an easily faked video wouldn't placate me either.
- heywhatupboys 3y agotime is time
- CyberDildonics 3y agoMight you think that source code would be much better proof and easier to send out?
- Sohcahtoa82 3y agoPoC || GTFO
- Y_Y 3y agoNot even an xor? Harsh.
- mike_hock 3y ago|| short-circuits.
- IggleSniggle 3y ago[flagged]
- sounds 3y agoOP here hadn't even bothered to read the article. That's the context of my reply. No PoCs going online so close to the disclosure, sorry.
- LtdJorge 3y agoWhat? The researcher that found it and wrote the article already posted a PoC that can be used to farm data from VMs in any VPS provider.
- saurik 3y agoI would like to think that the likelihood of being able to find a juicy target using one of these specific CPUs and who would have explicitly not updated their microcode for this exploit is much much much higher going after end users on the web than by attacking organized VPS providers.
- pests 3y agoIt's okay to admit you are wrong or don't have a working POC.
- pests 3y agoWhy is everyone claiming this is impossible in JavaScript? If you have a POC you should post it so others can learn of the danger. You've even been quoted elsewhere in this thread about this topic.
- 0xbadcafebee 3y agoSome people think you need "the ability to execute arbitrary code in an unprivileged context" to perform this exploit. Which is of course a false assumption. The bug class in this case is basically a user-after-free, for a function which keeps its state per-cpu-core, for a function that is (for almost all intents and purposes) unprivileged. From the article: We now know that basic operations like strlen, memcpy and strcmp will use the vector registers - so we can effectively spy on those operations happening anywhere on the system! It doesn’t matter if they’re happening in other virtual machines, sandboxes, containers, processes, whatever! All you need to do is write some JavaScript that will "trigger something called the XMM Register Merge Optimization2, followed by a register rename and a mispredicted vzeroupper". It's up to the hacker to determine how to do this explicitly in JS, but it's theoretically possible by literally any application at any time on any operating system. Even if some language or interpreter claims to prevent it, it's possible to find an exploit in that particular language/interpreter/etc to get it to happen. This is how exploit development works; if you can't go straight ahead, go sideways. I guarantee you that someone will find a way, if they haven't yet.
- KomoD 3y agoI'll take this as bullshit until there's a POC
- kzrdude 3y agoCloudflare blog also mentions javascript https://blog.cloudflare.com/zenbleed-vulnerability/ https://blog.cloudflare.com/zenbleed-vulnerability/
- loeg 3y agoMight just be parroting the claim from this thread, though.
- Mahn 3y agoI would think that Cloudflare is reputable enough that they would not state that claim without at least having some knowledge about it.
- loeg 3y agoThey have since rewritten that sentence from: > The attack can even be carried out remotely through JavaScript on a website, meaning that the attacker need not have physical access to the computer or server. https://web.archive.org/web/20230725020052/https://blog.cloudflare.com/zenbleed-vulnerability/ https://web.archive.org/web/20230725020052/https://blog.clou... To: > Currently the attack can only be executed by an attacker with an ability to execute native code on the affected machine. While there might be a possibility to execute this attack via the browser on the remote machine it hasn’t been yet demonstrated. https://web.archive.org/web/20230726204030/https://blog.cloudflare.com/zenbleed-vulnerability/ https://web.archive.org/web/20230726204030/https://blog.clou... I think I am vindicated -- they did just make that up, likely from the claim posted here.
- kzrdude 3y agoNo, it requires unprivileged arbitrary code execution
- kristopolous 3y agoBeyond what everyone else said, these types of exploits can break out of VMs. Unless I'm misreading it you could log into your $5 linode/digitalocean/aws machine and start reading other people's data on the host machine. There's tons of million dollar/month businesses on ~$20/month accounts on shared machines.
- rkrzr 3y agoIt allows the attacker to steal data like e.g. your (root) password.
- beebmam 3y agoIt is very clear, you just didn't read it. >We now know that basic operations like strlen, memcpy and strcmp will use the vector registers - so we can effectively spy on those operations happening anywhere on the system! It doesn’t matter if they’re happening in other virtual machines, sandboxes, containers, processes, whatever! >This works because the register file is shared by everything on the same physical core. In fact, two hyperthreads even share the same physical register file. >It turns out that mispredicting on purpose is difficult to optimize! It took a bit of work, but I found a variant that can leak about 30 kb per core, per second. >This is fast enough to monitor encryption keys and passwords as users login!
- hinkley 3y agoLiterally the intro says it might contain the root password. TLDR: The vector registers this bug affects are used for string functions like strcmp, so anything could get loaded into them, including passwords.
- timmaxw 3y agoIt allows the attacker to eavesdrop on the data going through operations like strcmp(), memcpy(), and strlen(). (These are the standard functions in C for working with strings; and many higher-level languages use them under the hood.) It works on any function that uses the XMM/YMM/ZMM registers. It's stochastic; the attacker randomly gets data from whatever happens to be using the XMM/YMM/ZMM registers at the time. So if the attacker could eavesdrop in the background constantly, they might eventually see a password. Or they might be able to trigger some system code that processes your password, then eavesdrop for the next few milliseconds. The attacker needs to run code on your machine. Unclear if running code in a web browser is sufficient or not. It requires an unusual sequence of machine instructions, which isn't necessarily possible in JS/WASM, but 'sounds' says they did it: https://news.ycombinator.com/item?id=36849767 https://news.ycombinator.com/item?id=36849767