Page 2 of 3

Re: Intel CPU security flaw

Posted: Sun Jan 07, 2018 2:02 pm
by folderol
Jack Winter wrote:Spectre is arguably the bigger problem...

Yes and No.
It's main attack vector is malicious javascript from compromised websites, and all the main browsers are rapidly pushing out patches to deal with it by both reducing the timer resolution available and also randomising it - the exploit relies on being able to accurately time cpu context switching actions.

Ultimately it needs to be sorted out in hardware, but this will take some time of course.

Re: Intel CPU security flaw

Posted: Sun Jan 07, 2018 3:18 pm
by Jack Winter
folderol wrote:
Jack Winter wrote:Spectre is arguably the bigger problem...

Yes and No.
It's main attack vector is malicious javascript from compromised websites, and all the main browsers are rapidly pushing out patches to deal with it by both reducing the timer resolution available and also randomising it - the exploit relies on being able to accurately time cpu context switching actions.

Ultimately it needs to be sorted out in hardware, but this will take some time of course.


Any other app running presents the same issue as a JS in a browser, it's just a question of how it gets on the computer. Granted us linux users are less prone to running binary blobs (disregarding the packaged binaries most of us install). IMO a huge problem for the other OSs, but still a potential issue for us as far as binary plugins, steam games, etc are concerned.

Re: Intel CPU security flaw

Posted: Sun Jan 07, 2018 11:56 pm
by Lyberta
Jack Winter wrote:but still a potential issue for us as far as binary plugins, steam games, etc are concerned.


Oh lol. Steam asset flips made for the purposes of money laundering will now be stealing passwords, nice.

Re: Intel CPU security flaw

Posted: Mon Jan 08, 2018 7:29 am
by tavasti
Jack Winter wrote:Any other app running presents the same issue as a JS in a browser, it's just a question of how it gets on the computer. Granted us linux users are less prone to running binary blobs (disregarding the packaged binaries most of us install).

That malicious code can be also in source code. Hiding something to what ever experimental code, and you will compile it yourself. Here is example spectre code, it is not perfect and will not work on all CPUs but on most of them, works: https://gist.github.com/ErikAugust/724d ... 2a9e3d4bb6

Re: Intel CPU security flaw

Posted: Tue Jan 09, 2018 9:52 am
by Jack Winter
tavasti wrote:
Jack Winter wrote:Any other app running presents the same issue as a JS in a browser, it's just a question of how it gets on the computer. Granted us linux users are less prone to running binary blobs (disregarding the packaged binaries most of us install).

That malicious code can be also in source code. Hiding something to what ever experimental code, and you will compile it yourself. Here is example spectre code, it is not perfect and will not work on all CPUs but on most of them, works: https://gist.github.com/ErikAugust/724d ... 2a9e3d4bb6


I think you missed my point which was the following: At the moment software needs to be compiled specifically to protect against spectre, something we can do with opensource. Hopefully this will be taken care of in the kernel thus protecting against all programs attempting a spectre style exploit.

Re: Intel CPU security flaw

Posted: Tue Jan 09, 2018 10:06 am
by sadko4u
We've tested spectre code on low-level developer's forum.
No one got it fully working.
Personally I tried to reproduce it on 4 linux machines:
AMD FX(tm)-4100 Quad-Core Processor - doesn't work even with changes from comments below.
AMD FX(tm)-8350 Eight-Core Processor - doesn't work.
AMD Athlon(tm) 64 X2 Dual Core Processor 4400+ - doesn't work.
Intel(R) Core(TM)2 Duo CPU T7250 @ 2.00GHz - rare unstable matches of symbols, generally fail.

So people who tested the PoC, made a conclusion that even this works, this works sometimes under some special circumstances that are currently not well-known.

Re: Intel CPU security flaw

Posted: Tue Jan 09, 2018 10:14 am
by tavasti
sadko4u wrote:We've tested spectre code on low-level developer's forum.
No one got it fully working.
Personally I tried to reproduce it on 4 linux machines:
AMD FX(tm)-4100 Quad-Core Processor - doesn't work even with changes from comments below.
AMD FX(tm)-8350 Eight-Core Processor - doesn't work.
AMD Athlon(tm) 64 X2 Dual Core Processor 4400+ - doesn't work.
Intel(R) Core(TM)2 Duo CPU T7250 @ 2.00GHz - rare unstable matches of symbols, generally fail.

So people who tested the PoC, made a conclusion that even this works, this works sometimes under some special circumstances that are currently not well-known.

Me and my friends tested that, and there was AMD FX processors and old Intels where that PoC code did not work. On all Intel cpu's made after Core2Duo worked. Assumption is that this PoC code is just quick scratch, which does not work on all processors, but it is just matter of more careful engineering to get it working on those also.

Re: Intel CPU security flaw

Posted: Wed Jan 10, 2018 3:44 pm
by khz

Re: Intel CPU security flaw

Posted: Thu Jan 18, 2018 11:23 am
by sadko4u
khz wrote:How to check Linux for Spectre and Meltdown vulnerability
https://www.cyberciti.biz/faq/check-linux-server-for-spectre-meltdown-vulnerability/

This checker does not execute PoC code, all checks are indirect. Are there better solutions?

Re: Intel CPU security flaw

Posted: Tue Jan 23, 2018 7:39 am
by tavasti
42low wrote:You don't have to do anything if you update, incl kernel-updating.
With the updates FF is fixed for this. The kernel is fixed. And the microcode is fixed (to open source). All checked.
At the end my computer is fixed for this bug and i didn't have to do anything for it. And my computers didn't loose any speed.


1) Spectre is such vulnerability, that it won't get 100% fixed with microcode, firmware and all OS fixes together.

2) Those fixes do have speed penalty, but amount depends what you run.

3) Intel says even themselves that firmware fix is buggy https://www.computerworld.com/article/3 ... fixes.html

Re: Intel CPU security flaw

Posted: Tue Jan 23, 2018 5:37 pm
by Lyberta
KPTI has arrived to Debian Testing and is not enabled on AMD CPUs. Just FYI.

Re: Intel CPU security flaw

Posted: Thu May 03, 2018 3:56 pm
by khz

Re: Intel CPU security flaw

Posted: Thu May 03, 2018 5:30 pm
by lilith
Image

:mrgreen:

Re: Intel CPU security flaw

Posted: Tue May 14, 2019 6:04 pm
by khz

Re: Intel CPU security flaw

Posted: Thu May 16, 2019 4:53 am
by khz