科技回声

8 条评论

kashyapc将近 7 年前

If you are using Linux-based virtualization (KVM), besides requiring updated kernel and Intel microcode (which is not yet available), you would also need updates for relevant layers: QEMU and libvirt. Patches are posted[1][2].Virtual Machines now need to be exposed a new Intel CPU feature flag: 'ssbd' (Speculative Store Bypass Disable).On microcode, from Red Hat's blog post[3]:In many (but not all) cases, full mitigation will also require updated microcode from the system microprocessor vendor. Red Hat intends to ship updated microcode as a convenience to our customers as it is made available to us. In the interim, customers are strongly advised to contact their OEM, ODM, or system manufacturer to receive this via a system BIOS update.[1] <a href="https://www.redhat.com/archives/libvir-list/2018-May/msg01560.html" rel="nofollow">https://www.redhat.com/archives/libvir-list/2018-May/msg0156...</a>[2] <a href="https://lists.gnu.org/archive/html/qemu-devel/2018-05/msg04795.html" rel="nofollow">https://lists.gnu.org/archive/html/qemu-devel/2018-05/msg047...</a>[3] <a href="https://www.redhat.com/en/blog/speculative-store-bypass-explained-what-it-how-it-works" rel="nofollow">https://www.redhat.com/en/blog/speculative-store-bypass-expl...</a>

my123将近 7 年前

AMD guidance:<a href="https://developer.amd.com/wp-content/resources/124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf" rel="nofollow">https://developer.amd.com/wp-content/resources/124441_AMD64_...</a>(setting an CPU-specific MSR and it's done for current CPUs, no microcode updates required.)<a href="https://www.amd.com/en/corporate/security-updates" rel="nofollow">https://www.amd.com/en/corporate/security-updates</a> has : "We have not identified any AMD x86 products susceptible to the Variant 3a vulnerability in our analysis to-date."

评论 #17126066 未加载

评论 #17123658 未加载

ENOTTY将近 7 年前

These are the links I found most explanatory<a href="https://bugs.chromium.org/p/project-zero/issues/detail?id=1528" rel="nofollow">https://bugs.chromium.org/p/project-zero/issues/detail?id=15...</a><a href="https://software.intel.com/sites/default/files/managed/b9/f9/336983-Intel-Analysis-of-Speculative-Execution-Side-Channels-White-Paper.pdf" rel="nofollow">https://software.intel.com/sites/default/files/managed/b9/f9...</a><a href="https://software.intel.com/sites/default/files/managed/c5/63/336996-Speculative-Execution-Side-Channel-Mitigations.pdf" rel="nofollow">https://software.intel.com/sites/default/files/managed/c5/63...</a><a href="https://blogs.technet.microsoft.com/srd/2018/05/21/analysis-and-mitigation-of-speculative-store-bypass-cve-2018-3639/" rel="nofollow">https://blogs.technet.microsoft.com/srd/2018/05/21/analysis-...</a><a href="https://developer.amd.com/wp-content/resources/124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf" rel="nofollow">https://developer.amd.com/wp-content/resources/124441_AMD64_...</a><a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html" rel="nofollow">https://www.intel.com/content/www/us/en/security-center/advi...</a> uCode update is only for variant 3a (MSR read) and for the global disable bit in the MSR. The standard mitigation is still LFENCE.<a href="https://docs.microsoft.com/en-us/cpp/security/developer-guidance-speculative-execution" rel="nofollow">https://docs.microsoft.com/en-us/cpp/security/developer-guid...</a> vulnerable code examples

swonderl将近 7 年前

Explained: <a href="https://www.redhat.com/en/blog/speculative-store-bypass-explained-what-it-how-it-works" rel="nofollow">https://www.redhat.com/en/blog/speculative-store-bypass-expl...</a>

评论 #17122911 未加载

cesarb将近 7 年前

A commenter over at arstechnica (<a href="https://arstechnica.com/gadgets/2018/05/new-speculative-execution-vulnerability-strikes-amd-arm-and-intel/?comments=1&post=35370251" rel="nofollow">https://arstechnica.com/gadgets/2018/05/new-speculative-exec...</a>) found an old article explaining the optimization which led to this vulnerability: "Faster Load Times - Intel Core versus AMD's K8 architecture" <a href="https://www.anandtech.com/show/1998/5" rel="nofollow">https://www.anandtech.com/show/1998/5</a>

pedro84将近 7 年前

Additional vendor info:<a href="https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability" rel="nofollow">https://developer.arm.com/support/arm-security-updates/specu...</a><a href="https://blogs.technet.microsoft.com/srd/2018/05/21/analysis-and-mitigation-of-speculative-store-bypass-cve-2018-3639/" rel="nofollow">https://blogs.technet.microsoft.com/srd/2018/05/21/analysis-...</a><a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html" rel="nofollow">https://www.intel.com/content/www/us/en/security-center/advi...</a>

exikyut将近 7 年前

Possibly completely unrelated question (this stuff is firmly over my head): toward the end of the first PoC there's<pre><code> /* if we don't break the loop after some time when it doesn't work, in NO_INTERRUPTS mode with SMP disabled, the machine will lock up */ </code></pre> The bit at the top of the that says<pre><code> ======== Demo code (no privilege boundaries crossed) ======== </code></pre> is suggestive and unambiguous, but the program executions show (with "$"s) that this is being executed as non-root.So... is this deadlock fundamentally related to the speculative execution glitch(es)?

评论 #17123651 未加载

评论 #17123241 未加载

评论 #17123194 未加载

rbanffy将近 7 年前

The MS advisory: <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180012" rel="nofollow">https://portal.msrc.microsoft.com/en-US/security-guidance/ad...</a>

8 条评论

kashyapc将近 7 年前

my123将近 7 年前

评论 #17126066 未加载

评论 #17123658 未加载

ENOTTY将近 7 年前

swonderl将近 7 年前

Explained: <a href="https://www.redhat.com/en/blog/speculative-store-bypass-explained-what-it-how-it-works" rel="nofollow">https://www.redhat.com/en/blog/speculative-store-bypass-expl...</a>

评论 #17122911 未加载

cesarb将近 7 年前

pedro84将近 7 年前

exikyut将近 7 年前

评论 #17123651 未加载

评论 #17123241 未加载

评论 #17123194 未加载

rbanffy将近 7 年前

The MS advisory: <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180012" rel="nofollow">https://portal.msrc.microsoft.com/en-US/security-guidance/ad...</a>

Speculative execution, variant 4: speculative store bypass

8 条评论

Speculative execution, variant 4: speculative store bypass

8 条评论