6 ms·
does it require physical access to the machine?
by ItsTotallyOn 3y ago
does it require physical access to the machine?
- xmodem 3y agoNo, only the ability to execute arbitrary code in an unprivileged context. Would probably have to be arbitrary x86_64 instructions - Javascript wouldn't cut it for this one.
- sounds 3y agoI was able to reproduce the vulnerability using javascript on a webpage. Therefore, no.
- _flux 3y agoWhat javascript was that, or did you create your own? I did not find any from this post.
- crtasm 3y agoMight you post a screen recording?
- CyberDildonics 3y agoMight you explain how that would prove anything?
- heywhatupboys 3y agoeffort to lie on a text comment << effort to lie with a video
- evandale 3y agoWe are on a tech site with highly intelligent individuals who have been programming computers since we've been in diapers. If you don't believe the text then how would you believe the video? Anything can be done in devtools beforehand and I can think of a million different ways to fake the video. Personally, if I didn't trust the text then an easily faked video wouldn't placate me either.
- heywhatupboys 3y agotime is time
- CyberDildonics 3y agoMight you think that source code would be much better proof and easier to send out?
- Sohcahtoa82 3y agoPoC || GTFO
- Y_Y 3y agoNot even an xor? Harsh.
- mike_hock 3y ago|| short-circuits.
- IggleSniggle 3y ago[flagged]
- sounds 3y agoOP here hadn't even bothered to read the article. That's the context of my reply. No PoCs going online so close to the disclosure, sorry.
- LtdJorge 3y agoWhat? The researcher that found it and wrote the article already posted a PoC that can be used to farm data from VMs in any VPS provider.
- saurik 3y agoI would like to think that the likelihood of being able to find a juicy target using one of these specific CPUs and who would have explicitly not updated their microcode for this exploit is much much much higher going after end users on the web than by attacking organized VPS providers.
- pests 3y agoIt's okay to admit you are wrong or don't have a working POC.
- pests 3y agoWhy is everyone claiming this is impossible in JavaScript? If you have a POC you should post it so others can learn of the danger. You've even been quoted elsewhere in this thread about this topic.
- 0xbadcafebee 3y agoSome people think you need "the ability to execute arbitrary code in an unprivileged context" to perform this exploit. Which is of course a false assumption. The bug class in this case is basically a user-after-free, for a function which keeps its state per-cpu-core, for a function that is (for almost all intents and purposes) unprivileged. From the article: We now know that basic operations like strlen, memcpy and strcmp will use the vector registers - so we can effectively spy on those operations happening anywhere on the system! It doesn’t matter if they’re happening in other virtual machines, sandboxes, containers, processes, whatever! All you need to do is write some JavaScript that will "trigger something called the XMM Register Merge Optimization2, followed by a register rename and a mispredicted vzeroupper". It's up to the hacker to determine how to do this explicitly in JS, but it's theoretically possible by literally any application at any time on any operating system. Even if some language or interpreter claims to prevent it, it's possible to find an exploit in that particular language/interpreter/etc to get it to happen. This is how exploit development works; if you can't go straight ahead, go sideways. I guarantee you that someone will find a way, if they haven't yet.
- KomoD 3y agoI'll take this as bullshit until there's a POC
- kzrdude 3y agoCloudflare blog also mentions javascript https://blog.cloudflare.com/zenbleed-vulnerability/ https://blog.cloudflare.com/zenbleed-vulnerability/
- loeg 3y agoMight just be parroting the claim from this thread, though.
- Mahn 3y agoI would think that Cloudflare is reputable enough that they would not state that claim without at least having some knowledge about it.
- loeg 3y agoThey have since rewritten that sentence from: > The attack can even be carried out remotely through JavaScript on a website, meaning that the attacker need not have physical access to the computer or server. https://web.archive.org/web/20230725020052/https://blog.cloudflare.com/zenbleed-vulnerability/ https://web.archive.org/web/20230725020052/https://blog.clou... To: > Currently the attack can only be executed by an attacker with an ability to execute native code on the affected machine. While there might be a possibility to execute this attack via the browser on the remote machine it hasn’t been yet demonstrated. https://web.archive.org/web/20230726204030/https://blog.cloudflare.com/zenbleed-vulnerability/ https://web.archive.org/web/20230726204030/https://blog.clou... I think I am vindicated -- they did just make that up, likely from the claim posted here.
- kzrdude 3y agoNo, it requires unprivileged arbitrary code execution
- kristopolous 3y agoBeyond what everyone else said, these types of exploits can break out of VMs. Unless I'm misreading it you could log into your $5 linode/digitalocean/aws machine and start reading other people's data on the host machine. There's tons of million dollar/month businesses on ~$20/month accounts on shared machines.