TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Reptar

601 点作者 abhi9u超过 1 年前

33 条评论

dang超过 1 年前
Related: <a href="https:&#x2F;&#x2F;cloud.google.com&#x2F;blog&#x2F;products&#x2F;identity-security&#x2F;google-researchers-discover-reptar-a-new-cpu-vulnerability" rel="nofollow noreferrer">https:&#x2F;&#x2F;cloud.google.com&#x2F;blog&#x2F;products&#x2F;identity-security&#x2F;goo...</a><p>(via <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38268043">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38268043</a>, but we merged the comments hither)
评论 #38270382 未加载
xyst超过 1 年前
Reading this makes me realize how little I know of the hardware that runs my software<p>&gt; Prefixes allow you to change how instructions behave by enabling or disabling features<p>Why do we need “prefixes” to disable or enable features? Is this for dynamically toggling feature so you don’t have to go into BIOS?
评论 #38269057 未加载
评论 #38270421 未加载
评论 #38268799 未加载
评论 #38269024 未加载
评论 #38268724 未加载
评论 #38272654 未加载
评论 #38269498 未加载
tedunangst超过 1 年前
Their diagnosis reminds me of what happened when qemu ran into repz ret. <a href="https:&#x2F;&#x2F;repzret.org&#x2F;p&#x2F;repzret&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;repzret.org&#x2F;p&#x2F;repzret&#x2F;</a>
ChrisRR超过 1 年前
I really think HN rules should disallow titles like this. It tells me nothing about what the link is, the URL is even more confusing.<p>I think for such meaningless titles that the poster should add a small description
评论 #38289431 未加载
krylon超过 1 年前
This is very well written. I know little about assembly programming and Intel&#x27;s ISA, let alone their microarchitectures, but I could follow the explanation and feel like I have a rough understanding of what is going on here.<p>Does anyone know if AMD CPUs are affected?
quotemstr超过 1 年前
If the problem really is that the processor is confused about instruction length, I&#x27;m impressed that this problem can be fixed in microcode without a huge performance hit: my intuition (which could be totally wrong) is that computing the length of an instruction would be something synthesized directly to logic gates.<p>Actually, come to think of it, my hunch is that the uOP decoder (presumably in hardware) is actually fine and that the microcoded optimized copy routine is trying to infer things about the uOP stream that just aren&#x27;t true --- &quot;Oh, this is a rep mov, so of course I need to go backward two uOPs to loop&quot; or something.<p>I expect Intel&#x27;s CPU team isn&#x27;t going to divulge the details though. :-)
atesti超过 1 年前
I don&#x27;t understand &quot;ERMS&quot; and &quot;FSRM&quot; and there seems to be nothing good on google about it.<p>Are these just CPUID flags that tell you that you can use a rep movsb for maximum performance instead of optimized SSE memcpy implementations? Or is it a special encoding&#x2F;prefix for rep movsb to make it faster? In case of the later, why would that be necessary? How does one make use of fsrm?
评论 #38274293 未加载
评论 #38274315 未加载
评论 #38277234 未加载
writeslowly超过 1 年前
I noticed the Intel advisory [1] says the following<p>Intel would like to thank Intel employees:[...] for finding this issue internally.<p>Intel would like to thank Google Employees: [...] for also reporting this issue.<p>[1] <a href="https:&#x2F;&#x2F;www.intel.com&#x2F;content&#x2F;www&#x2F;us&#x2F;en&#x2F;security-center&#x2F;advisory&#x2F;intel-sa-00950.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.intel.com&#x2F;content&#x2F;www&#x2F;us&#x2F;en&#x2F;security-center&#x2F;advi...</a>
评论 #38269282 未加载
评论 #38269129 未加载
saagarjha超过 1 年前
See also Intel’s advisory, which has a description of impact: <a href="https:&#x2F;&#x2F;www.intel.com&#x2F;content&#x2F;www&#x2F;us&#x2F;en&#x2F;security-center&#x2F;advisory&#x2F;intel-sa-00950.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.intel.com&#x2F;content&#x2F;www&#x2F;us&#x2F;en&#x2F;security-center&#x2F;advi...</a><p>&gt; Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and&#x2F;or information disclosure and&#x2F;or denial of service via local access.
评论 #38273862 未加载
malkia超过 1 年前
Konrad Magnusson from Paradox Interactive (Victoria 3) team found something related to that and mimalloc -&gt; <a href="https:&#x2F;&#x2F;github.com&#x2F;microsoft&#x2F;mimalloc&#x2F;issues&#x2F;807">https:&#x2F;&#x2F;github.com&#x2F;microsoft&#x2F;mimalloc&#x2F;issues&#x2F;807</a><p>Not sure if fully related, but possibly.
评论 #38273306 未加载
评论 #38279416 未加载
doublerabbit超过 1 年前
Any reason to why its named after the dinosaur from the cartoon Rugrats? Or was that what was on TV at the time?<p>Maybe I should start hacking while watching Teenage Mutant Ninja Turtles.
评论 #38269588 未加载
评论 #38268730 未加载
评论 #38268663 未加载
jefc1111超过 1 年前
This was a lot more fun than the Google puff piece.
Borg3超过 1 年前
Uhm.. Why not padding using NOP ? Looks much more safer that slapping around random prefixes.
评论 #38283649 未加载
评论 #38275328 未加载
bobim超过 1 年前
Is it even possible to design a cpu with out-of-order and speculative execution that would have no security issue? Is the future leads to a swarm of disconnected A55 cores each running a single application?
评论 #38268986 未加载
评论 #38269214 未加载
评论 #38269017 未加载
评论 #38273653 未加载
评论 #38268974 未加载
评论 #38269673 未加载
varispeed超过 1 年前
It&#x27;s going to be a pain for cloud and shared hosting.<p>Most likely dedicated resources on demand will be the future. Some companies already offer it.
评论 #38275684 未加载
rep_lodsb超过 1 年前
The REX prefix is redundant for &#x27;movsb&#x27;, but not &#x27;movsd&#x27;&#x2F;&#x27;movsq&#x27; (moving either 32- or 64-bit words, depending on the prefix). That may have something to do with the bug, if there is any shared microcode between those instructions?
tasty_freeze超过 1 年前
Benchmarking is always problematic -- what is a good representative workload? All the same, I&#x27;d be curious if the ucode update that plugs this bug has affected CPU performance, eg, it diverts the &quot;fast short rep move&quot; path to just use the &quot;bad for short moves but great for long moves&quot; version.
评论 #38269277 未加载
评论 #38270142 未加载
评论 #38275657 未加载
Flow超过 1 年前
Would be possible to describe a modern CPU in something like TLA+ to find all non-electrical problems like these?
评论 #38268921 未加载
评论 #38269323 未加载
评论 #38271897 未加载
评论 #38268746 未加载
quietpain超过 1 年前
<p><pre><code> ...our validation pipeline produced an interesting assertion... </code></pre> What is a validation pipeline?
评论 #38269379 未加载
评论 #38269376 未加载
评论 #38269367 未加载
farhanhubble超过 1 年前
This is such an interesting read, right in the league of &quot;Smashing the stack&quot; and &quot;row hammer&quot;. As someone with very little knowledge of security I wonder if CPU designers do any kind of formal verification of the microcode architecture?
评论 #38273327 未加载
tommiegannert超过 1 年前
Nice find. That indeed sounds terrible for anyone executing external code in what they believe to be sandboxes. Good thing it can be patched (and AFAICT, it seems to be a good fix, rather than a performance-affecting workaround.)
eigenform超过 1 年前
I wonder which MCEs are being taken when this is triggered?
blauditore超过 1 年前
Can someone give a TL;DR for non-CPU experts? All technical articles seem pretty long and&#x2F;or complex.
评论 #38269827 未加载
评论 #38269565 未加载
asylteltine超过 1 年前
Interesting write up. The submission needs a better and more accurate title though
ZoomerCretin超过 1 年前
Intel is a known partner of the NSA. If Intel was intentionally creating backdoors at the behest of the NSA, how would they look different from this vulnerability and the many other discovered vulnerabilities before it?
评论 #38269990 未加载
评论 #38270078 未加载
评论 #38269948 未加载
评论 #38270138 未加载
frontalier超过 1 年前
The date on the article is for tomorrow?
评论 #38269664 未加载
ShadowBanThis01超过 1 年前
Is what? Another useless title.
Lammy超过 1 年前
&gt; the processor would begin to report machine check exceptions and halt.<p>I get it <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=dXekDCcw2FE">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=dXekDCcw2FE</a>
评论 #38272249 未加载
评论 #38279411 未加载
mike_d超过 1 年前
The most awesome part:<p>&gt; This bug was independently discovered by multiple research teams within Google, including the silifuzz team and Google Information Security Engineering.
评论 #38279422 未加载
tazjin超过 1 年前
Can we get a better title for this? &quot;Reptar - new CPU vulnerability&quot; or something. I thought it was some random startup ad until I picked up the name somewhere else.
评论 #38278027 未加载
评论 #38274999 未加载
评论 #38279431 未加载
yodon超过 1 年前
Dupe: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38268043">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38268043</a><p>(As of this writing, this post has more votes, the other has more comments)
评论 #38269941 未加载
purpleidea超过 1 年前
In this new Intel microcode bug, Tavis writes:<p>&quot;We know something strange is happening, but how microcode works in modern systems is a closely guarded secret.&quot;<p>My question: How likely is it that this is an intentional bug door that was added into the microcode by Intel and its government partners?<p>I don&#x27;t know enough about microcode and CPU&#x27;s to be able to answer this myself, so backed-up opinions welcome!
评论 #38279231 未加载
评论 #38279393 未加载
rvba超过 1 年前
It looks like Intel was cutting corners to be faster than AMD and now all those thigs come out. How much slower will all those processors be after multiple errata? 10%? 30%? 50%?<p>In a duopoly market there seems to be no real competition. And yes I know that some (not all) bugs also happen for AMD.
评论 #38269391 未加载
评论 #38269610 未加载
评论 #38269462 未加载