[ethics404]

What is Meltdown Vulnerability?

This vulnerability makes it possible for a program running on a computer to break into an operating system’s central memory, tapping into data it is not meant to have access to.

It stem from a basic design change that was made to many computer chips around a decade ago to make them run faster. This allowed applications running on a computer to access data contained in the machine’s operating system memory before they actually needed it.

The change enabled programs to anticipate some of the work they might be required to do in advance — a process known as “speculative execution” — but has now been found to provide a route for malicious programs to see sensitive data held on the machine.

Microsoft rushed out a patch to the Windows operating system on Wednesday to fix this vulnerability.


What is Spectre Vulnerability?

This vulnerability makes it possible for a program running on a chip to access data in a separate program, without any need to call on the operating system.

The Meltdown and Spectre vulnerabilities disclosed to the public on Wednesday.

The chip problem was first discovered by a security researcher at Google in June last year, according to both Intel and the search company. In a blog post, Google said it had “collaborated with hardware and software manufacturers across the industry to help protect their users and the broader web”, while also working to protect its own systems.

The flaw could make it possible for hackers to see highly sensitive information like passwords and a computer’s encryption keys.

It would take months before fixes could be rolled out and programs fully tested.

Source: Financial Times

[mothered]

This vulnerability makes it possible for a program running on a computer to break into an operating system’s central memory, tapping into data it is not meant to have access to.

I'd be Interested to see "exactly" what type of memory this refers to.

SRAM & DRAM are both volatile, meaning all data Is lost once the system Is powered down/rebooted.

[MrSecurity]

00000000000000000000000=
-

[phyrrus9]

This vulnerability makes it possible for a program running on a computer to break into an operating system’s central memory, tapping into data it is not meant to have access to.

I'd be Interested to see "exactly" what type of memory this refers to.

SRAM & DRAM are both volatile, meaning all data Is lost once the system Is powered down/rebooted.

These attacks work with the L1 cache lines and branch prediction, using out of bounds requests as part of a carefully crafted instruction sequence (where execution is reset due to a prediction failure), leaving the read data in the cache under user control. Reads this way are extremely slow (2kb/s), but could be useful in determining ASLR slides.

It is useful to note that AMD processors have virtually no risk.

[mothered]

This vulnerability makes it possible for a program running on a computer to break into an operating system’s central memory, tapping into data it is not meant to have access to.

I'd be Interested to see "exactly" what type of memory this refers to.

SRAM & DRAM are both volatile, meaning all data Is lost once the system Is powered down/rebooted.

These attacks work with the L1 cache lines and branch prediction, using out of bounds requests as part of a carefully crafted instruction sequence (where execution is reset due to a prediction failure), leaving the read data in the cache under user control. Reads this way are extremely slow (2kb/s), but could be useful in determining ASLR slides.

It is useful to note that AMD processors have virtually no risk.

Now It makes sense being CPU-based namely It's cache. Very clever.

Thanks for the explanation.

[phyrrus9]

I'd be Interested to see "exactly" what type of memory this refers to.

SRAM & DRAM are both volatile, meaning all data Is lost once the system Is powered down/rebooted.

These attacks work with the L1 cache lines and branch prediction, using out of bounds requests as part of a carefully crafted instruction sequence (where execution is reset due to a prediction failure), leaving the read data in the cache under user control. Reads this way are extremely slow (2kb/s), but could be useful in determining ASLR slides.

It is useful to note that AMD processors have virtually no risk.

Now It makes sense being CPU-based namely It's cache. Very clever.

Thanks for the explanation.

Here is the whitepaper on the bug, this explains it at the surface level.

tl;dr: this bug likely won't effect you in a security way, attacks need to be targeted at specific data, and user class systems aren't important enough to get that kind of targeting. you will, however, notice an (up to) 30% speed DECREASE if you are using an Intel CPU made after 1995 or the FX-832x class. FX-83xx, FX9xxx, have no risk, and ryzen has "virtually no risk". Unfortunately this means that ryzen will probably get the (forced) patches and also experience some speed issues.

[mothered]

you will, however, notice an (up to) 30% speed DECREASE if you are using an Intel CPU made after 1995 or the FX-82xx class. FX-83xx, FX9xxx, have no risk, and ryzen has "virtually no risk".

I was under the Impression that AMD Is not affected.

Is the FX-82xx the second gen AMD CPU In It's class?

[phyrrus9]

you will, however, notice an (up to) 30% speed DECREASE if you are using an Intel CPU made after 1995 or the FX-82xx class. FX-83xx, FX9xxx, have no risk, and ryzen has "virtually no risk".

I was under the Impression that AMD Is not affected.

Is the FX-82xx the second gen AMD CPU In It's class?

My bad, it was 832x not 82xx. this was the only CPU that any of the PoC's had any data come back on. It was unclear if that data was useful or not, but they got a result on that one. If I remember correctly, AMD did some weird things with the FX line, for instance the 9590 is an 8370 with a new vreg and only minor other changes. The 8320 had 2 versions, 8320 and 8320E, and it could have been that technical update that introduced the exploitable feature.

[mothered]

you will, however, notice an (up to) 30% speed DECREASE if you are using an Intel CPU made after 1995 or the FX-82xx class. FX-83xx, FX9xxx, have no risk, and ryzen has "virtually no risk".

I was under the Impression that AMD Is not affected.

Is the FX-82xx the second gen AMD CPU In It's class?

My bad, it was 832x not 82xx. If I remember correctly, AMD did some weird things with the FX line, for instance the 9590 is an 8370 with a new vreg and only minor other changes. The 8320 had 2 versions, 8320 and 8320E, and it could have been that technical update that introduced the exploitable feature.

You had me confused for a minute, all good.

I remember the Inconsistencies with AMD, but not It's exactness. The 8320 (If I'm correct) dates back around 5 years.

[Synthx]

This was very interesting to read. I actually learned some stuff from it tbh. Thanks for the share alert.