Intel hardware bug

[Jules Gilbert via freebsd-arch]

Sorry guys, you just convinced me that no one, not the NSA, not the FSB, no one!, has in the past, or will in the future be able to exploit this to actually do something not nice.
I'm not saying that the hardware shouldn't be fixed, I am saying that we don't need to worry about this.
In the early days of DOS their was a hardware bug in nearly all floppy controllers, it wasn't even discovered until (I think,) 1985 or so.  The thing is..., no one reported unusual problems.
So what is this, really?, it's a market exploit opportunity for AMD.

1) Fetch kernel/other process memory, which eventually faults
2) Do a bit-shift/mask operation to pluck out one bit of the fetched
value.  This gets executed speculatively on the fetched value in (1).
3) Execute fetches of two different addresses depending on some bit in
the fetched value in (1) (say, 0x100000 for 0 vs 0x200000 for 1).  This
also gets executed speculatively despite the fact that (1) ends up faulting.
4) Recover from fault in (1)
5) Measure performance of accesses to the two addresses to determine
which one is cached.

I must say, that's one hell of a round-about way to read just one bit that
you wern't supposed to have access to.  But of course, that doesn't really
matter if you are an attacker.

If the above steps can be repeated, programatically, ad infinitum, to read
bits from "protected" memory... and I see no reason why they can't be...
then yea, this bug is every bit as bad as the media is making it out to be,
and maybe even worse.

All your secrets are belong to us!

Time to invest in abacuses... or is that abacai?


Regards,
rfg
_______________________________________________
freebsd-***@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-***@freebsd.org"

[Eric McCorkle]

Post by Jules Gilbert via freebsd-arch
Sorry guys, you just convinced me that no one, not the NSA, not the FSB,
no one!, has in the past, or will in the future be able to exploit this
to actually do something not nice.

Attacks have already been demonstrated, pulling secrets out of kernel
space with meltdown and http headers/passwords out of a browser with
spectre. Javascript PoCs are already in existence, and we can expect
them to find their way into adware-based malware within a week or two.

Also, I'd be willing to bet you a year's rent that certain three-letter
organizations have known about and used this for some time.

Post by Jules Gilbert via freebsd-arch
So what is this, really?, it's a market exploit opportunity for AMD.

Don't bet on it. There's reports of AMD vulnerabilities, also for ARM.
I doubt any major architecture is going to make it out unscathed. (But
if one does, my money's on Power)

[Andrew Duane]

I wouldn't think Javascript would have the accurate timing required to leverage this attack, but I don't really know enough about the language.

Regardless, is there someone within FreeBSD that is working on patches for this set of problems, at least for Intel? Linux already has at least some, and I believe NetBSD does too. Of course Windows has already pushed out a Windows10 fix, 7 and 8 are coming.

....................................
Andrew L. Duane - Principal Resident Engineer
AT&T Advanced Services Technical Lead
Juniper Quality Ambassador
m   +1 603.770.7088
o +1 408.933.6944 (2-6944)
skype: andrewlduane
***@juniper.net

-----Original Message-----
From: owner-freebsd-***@freebsd.org [mailto:owner-freebsd-***@freebsd.org] On Behalf Of Eric McCorkle
Sent: Friday, January 5, 2018 7:43 AM
To: Jules Gilbert <***@yahoo.com>; Ronald F. Guilmette <***@tristatelogic.com>; Freebsd Security <freebsd-***@freebsd.org>; Brett Glass <***@lariat.org>; Dag-Erling Smørgrav <***@des.no>; Poul-Henning Kamp <***@phk.freebsd.dk>; freebsd-***@freebsd.org; FreeBSD Hackers <freebsd-***@freebsd.org>; Shawn Webb <***@hardenedbsd.org>; Nathan Whitehorn <***@freebsd.org>
Subject: Re: Intel hardware bug

Post by Jules Gilbert via freebsd-arch
Sorry guys, you just convinced me that no one, not the NSA, not the
FSB, no one!, has in the past, or will in the future be able to
exploit this to actually do something not nice.

Attacks have already been demonstrated, pulling secrets out of kernel space with meltdown and http headers/passwords out of a browser with spectre. Javascript PoCs are already in existence, and we can expect them to find their way into adware-based malware within a week or two.

Also, I'd be willing to bet you a year's rent that certain three-letter organizations have known about and used this for some time.

Post by Jules Gilbert via freebsd-arch
So what is this, really?, it's a market exploit opportunity for AMD.

Don't bet on it. There's reports of AMD vulnerabilities, also for ARM.
I doubt any major architecture is going to make it out unscathed. (But if one does, my money's on Power)

[Eric McCorkle]

Don't bet on it.  There's reports of AMD vulnerabilities, also for ARM.
I doubt any major architecture is going to make it out unscathed.  (But
if one does, my money's on Power)
Nope, the only arch that I'm aware of that gets past this is SPARC(hah!)
due to the seperate userland and kernel memory virtualization.

Alas, poor Sparc. I knew them, Horatio...

It looks like Red Hat is indeed reporting Power9 to be vulnerable:

https://access.redhat.com/security/vulnerabilities/speculativeexecution

Unfortunate. I hope they get fixed silicon out in time for the Talos II
workstation.

[Nathan Whitehorn]

Post by Eric McCorkle

Post by Jules Gilbert via freebsd-arch
Sorry guys, you just convinced me that no one, not the NSA, not the FSB,
no one!, has in the past, or will in the future be able to exploit this
to actually do something not nice.

Attacks have already been demonstrated, pulling secrets out of kernel
space with meltdown and http headers/passwords out of a browser with
spectre. Javascript PoCs are already in existence, and we can expect
them to find their way into adware-based malware within a week or two.
Also, I'd be willing to bet you a year's rent that certain three-letter
organizations have known about and used this for some time.

Post by Jules Gilbert via freebsd-arch
So what is this, really?, it's a market exploit opportunity for AMD.

Don't bet on it. There's reports of AMD vulnerabilities, also for ARM.
I doubt any major architecture is going to make it out unscathed. (But
if one does, my money's on Power)

Nope, the only arch that I'm aware of that gets past this is SPARC(hah!)
due to the seperate userland and kernel memory virtualization.
_______________________________________________

POWER has the same thing. It's actually stronger separation, since user
processes don't share addresses either -- all processes, including the
kernel, have windowed access to an 80-bit address space, so no process
can even describe an address in another process's address space. There
are ways, of course, in which IBM could have messed up the
implementation, so the fact that it *should* be secure does not mean it
*is*.

SPARC avoids the issue because almost all implementations are in-order.
-Nathan

[Dag-Erling Smørgrav]

Post by Jules Gilbert via freebsd-arch
Sorry guys, you just convinced me that no one, not the NSA, not the
FSB, no one!, has in the past, or will in the future be able to
exploit this to actually do something not nice.

The technique has already been proven by multiple independent parties to
work quite well, allowing an attacker to read kernel memory at speeds of
up to 500 kB/s. But I guess you know better...

DES

[Jules Gilbert via freebsd-arch]

Ah, sorry I'm wrong.  I apologize.  I won't intrude further.  I spoke up because selectively choosing to read sections of kernel memory is one thing, obtaining useful information from an arbitrary block of kernel memory you don't get to choose is quite another.
But their are several people here I respect very much and if they say I'm wrong about an area they focus on,... me bad.

Post by Jules Gilbert via freebsd-arch
Sorry guys, you just convinced me that no one, not the NSA, not the
FSB, no one!, has in the past, or will in the future be able to
exploit this to actually do something not nice.

The technique has already been proven by multiple independent parties to
work quite well, allowing an attacker to read kernel memory at speeds of
up to 500 kB/s.  But I guess you know better...

DES

[Chris H]

Post by Eric McCorkle

Don't bet on it.  There's reports of AMD vulnerabilities, also for ARM.
I doubt any major architecture is going to make it out unscathed.  (But
if one does, my money's on Power)
Nope, the only arch that I'm aware of that gets past this is SPARC(hah!)
due to the seperate userland and kernel memory virtualization.

Alas, poor Sparc. I knew them, Horatio...

Ahh, good ol' SPARC!

Post by Eric McCorkle
https://access.redhat.com/security/vulnerabilities/speculativeexecution
Unfortunate. I hope they get fixed silicon out in time for the Talos II
workstation.

What *I* want to know; is whether they're going to drastically reduce the
price on all the affected processors? As it stands, they should be
practically giving them away. How is it that the burden lies on the OS
vendors, and not the manufacturers?!

--Chris

[Cy Schubert]

According to a Red Hat announcement, Power and Series z are also vulnerable.

---
Sent using a tiny phone keyboard.
Apologies for any typos and autocorrect.
Also, this old phone only supports top post. Apologies.

Cy Schubert
<***@cschubert.com> or <***@freebsd.org>
The need of the many outweighs the greed of the few.
---

-----Original Message-----
From: Eric McCorkle
Sent: 05/01/2018 04:48
To: Jules Gilbert; Ronald F. Guilmette; Freebsd Security; Brett Glass; Dag-Erling Smørgrav; Poul-Henning Kamp; freebsd-***@freebsd.org; FreeBSD Hackers; Shawn Webb; Nathan Whitehorn
Subject: Re: Intel hardware bug

Post by Jules Gilbert via freebsd-arch
Sorry guys, you just convinced me that no one, not the NSA, not the FSB,
no one!, has in the past, or will in the future be able to exploit this
to actually do something not nice.

Attacks have already been demonstrated, pulling secrets out of kernel
space with meltdown and http headers/passwords out of a browser with
spectre. Javascript PoCs are already in existence, and we can expect
them to find their way into adware-based malware within a week or two.

Also, I'd be willing to bet you a year's rent that certain three-letter
organizations have known about and used this for some time.

Post by Jules Gilbert via freebsd-arch
So what is this, really?, it's a market exploit opportunity for AMD.

Don't bet on it. There's reports of AMD vulnerabilities, also for ARM.
I doubt any major architecture is going to make it out unscathed. (But
if one does, my money's on Power)
_______________________________________________
freebsd-***@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-arch
To unsubscribe, send any mail to "freebsd-arch-***@freebsd.org"

[Freddie Cash]

Post by Cy Schubert
According to a Red Hat announcement, Power and Series z are also vulnerable.
​

​There's a lot of confusion in the media, press releases, and announcements
due to conflating Spectre and Meltdown.

Meltdown (aka CVE-2017-5754) is the issue that affects virtually all Intel
CPUs and specific ARM Cortex-A CPUs. This allows read-access to kernel
memory from unprivileged processes (ring 3 apps get read access to ring 0
memory).​ IBM POWER, Oracle Sparc, and AMD Zen are not affected by this
issue as they provide proper separation between kernel memory maps and
userland memory maps; or they aren't OoO architectures that use speculative
execution in this manner.

Spectre (aka CVE-2017-5715 and CVE-2017-5753) is the issue that affects all
CPUs (Intel, AMD, ARM, IBM, Oracle, etc) and allows userland processes to
read memory assigned to other userland processes (but does NOT give access
to kernel memory).

​IOW, POWER and Sparc are vulnerable to Spectre, but not vulnerable to
Meltdown.

[Jan Knepper]

Thank you!

The news indeed does not properly understand the difference, nor which
problem affects which hardware/CPU and in many ways acts like it is "the
end of the world".

Post by Freddie Cash

Post by Cy Schubert
According to a Red Hat announcement, Power and Series z are also vulnerable.
​

​There's a lot of confusion in the media, press releases, and announcements
due to conflating Spectre and Meltdown.
Meltdown (aka CVE-2017-5754) is the issue that affects virtually all Intel
CPUs and specific ARM Cortex-A CPUs. This allows read-access to kernel
memory from unprivileged processes (ring 3 apps get read access to ring 0
memory).​ IBM POWER, Oracle Sparc, and AMD Zen are not affected by this
issue as they provide proper separation between kernel memory maps and
userland memory maps; or they aren't OoO architectures that use speculative
execution in this manner.
Spectre (aka CVE-2017-5715 and CVE-2017-5753) is the issue that affects all
CPUs (Intel, AMD, ARM, IBM, Oracle, etc) and allows userland processes to
read memory assigned to other userland processes (but does NOT give access
to kernel memory).
​IOW, POWER and Sparc are vulnerable to Spectre, but not vulnerable to
Meltdown.

[John-Mark Gurney]

Post by Freddie Cash
Spectre (aka CVE-2017-5715 and CVE-2017-5753) is the issue that affects all
CPUs (Intel, AMD, ARM, IBM, Oracle, etc) and allows userland processes to
read memory assigned to other userland processes (but does NOT give access
to kernel memory).

No, Spectre does not allow one userland process to read another userland
process's memory.. It allows an attacker to read any memory within the
same process..

[Freddie Cash]

Post by Freddie Cash
Spectre (aka CVE-2017-5715 and CVE-2017-5753) is the issue that affects all
CPUs (Intel, AMD, ARM, IBM, Oracle, etc) and allows userland processes to
read memory assigned to other userland processes (but does NOT give access
to kernel memory).

No, Spectre does not allow one userland process to read another userland
process's memory.. It allows an attacker to read any memory within the
same process.


That's variant 1 of Spectre.

Variant 2 crosses process boundaries. It's the one that has VM hosting
systems worried as a process running in VM1 can read memory assigned to VM2.

Cheers,
Freddie

[K. Macy]

Post by Cy Schubert
According to a Red Hat announcement, Power and Series z are also vulnerable.

Link?

Post by Cy Schubert
---
-----Original Message-----
From: Eric McCorkle
Sent: 05/01/2018 04:48
Subject: Re: Intel hardware bug

Post by Jules Gilbert via freebsd-arch
Sorry guys, you just convinced me that no one, not the NSA, not the FSB,
no one!, has in the past, or will in the future be able to exploit this
to actually do something not nice.

Attacks have already been demonstrated, pulling secrets out of kernel
space with meltdown and http headers/passwords out of a browser with
spectre. Javascript PoCs are already in existence, and we can expect
them to find their way into adware-based malware within a week or two.
Also, I'd be willing to bet you a year's rent that certain three-letter
organizations have known about and used this for some time.

Post by Jules Gilbert via freebsd-arch
So what is this, really?, it's a market exploit opportunity for AMD.

Don't bet on it. There's reports of AMD vulnerabilities, also for ARM.
I doubt any major architecture is going to make it out unscathed. (But
if one does, my money's on Power)
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-arch
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-arch

[K. Macy]

Post by Cy Schubert
According to a Red Hat announcement, Power and Series z are also vulnerable.

Link?

Spectre yes. Meltdown no. Spectre is a problem but much harder to
exploit. It's Intel's handling of meltdown that is seriously grounds
for table flipping.

https://www.ibm.com/blogs/psirt/potential-impact-processors-power-family/

Post by Cy Schubert
---
-----Original Message-----
From: Eric McCorkle
Sent: 05/01/2018 04:48
Subject: Re: Intel hardware bug

Post by Jules Gilbert via freebsd-arch
Sorry guys, you just convinced me that no one, not the NSA, not the FSB,
no one!, has in the past, or will in the future be able to exploit this
to actually do something not nice.

Attacks have already been demonstrated, pulling secrets out of kernel
space with meltdown and http headers/passwords out of a browser with
spectre. Javascript PoCs are already in existence, and we can expect
them to find their way into adware-based malware within a week or two.
Also, I'd be willing to bet you a year's rent that certain three-letter
organizations have known about and used this for some time.

Post by Jules Gilbert via freebsd-arch
So what is this, really?, it's a market exploit opportunity for AMD.

Don't bet on it. There's reports of AMD vulnerabilities, also for ARM.
I doubt any major architecture is going to make it out unscathed. (But
if one does, my money's on Power)
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-arch
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-arch

[Adam Vande More]

Post by Cy Schubert

Post by Cy Schubert
According to a Red Hat announcement, Power and Series z are also

vulnerable.
Link?

https://access.redhat.com/security/vulnerabilities/speculativeexecution

[Cy Schubert]

https://access.redhat.com/security/vulnerabilities/speculativeexecution?sc_cid=701f2000000tsLNAAY&

---
Sent using a tiny phone keyboard.
Apologies for any typos and autocorrect.
Also, this old phone only supports top post. Apologies.

Cy Schubert
<***@cschubert.com> or <***@freebsd.org>
The need of the many outweighs the greed of the few.
---

-----Original Message-----
From: K. Macy
Sent: 05/01/2018 11:37
To: Cy Schubert
Cc: Eric McCorkle; Jules Gilbert; Ronald F. Guilmette; Freebsd Security; Brett Glass; Dag-Erling Smørgrav; Poul-Henning Kamp; freebsd-***@freebsd.org; FreeBSD Hackers; Shawn Webb; Nathan Whitehorn
Subject: Re: Intel hardware bug

Post by Cy Schubert
According to a Red Hat announcement, Power and Series z are also vulnerable.

Link?

Post by Cy Schubert
---
-----Original Message-----
From: Eric McCorkle
Sent: 05/01/2018 04:48
Subject: Re: Intel hardware bug

Post by Jules Gilbert via freebsd-arch
Sorry guys, you just convinced me that no one, not the NSA, not the FSB,
no one!, has in the past, or will in the future be able to exploit this
to actually do something not nice.

Attacks have already been demonstrated, pulling secrets out of kernel
space with meltdown and http headers/passwords out of a browser with
spectre. Javascript PoCs are already in existence, and we can expect
them to find their way into adware-based malware within a week or two.
Also, I'd be willing to bet you a year's rent that certain three-letter
organizations have known about and used this for some time.

Post by Jules Gilbert via freebsd-arch
So what is this, really?, it's a market exploit opportunity for AMD.

Don't bet on it. There's reports of AMD vulnerabilities, also for ARM.
I doubt any major architecture is going to make it out unscathed. (But
if one does, my money's on Power)
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-arch
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-arch