Security Intel Processor Flaw 'kernel memory leaking' [Spectre & Meltdown]

BamaStangGuy · Mar 13, 2020

I spent nearly an hour spinning up Linodes the other day just to get an Epyc processor. Nothing I personally rely on will ever touch Intel processors. Typing this from my AMD 1950x Threadripper. AMD from here on out for the foreseeable future.

eva2000 · Mar 13, 2020

BamaStangGuy said: ↑

I spent nearly an hour spinning up Linodes the other day just to get an Epyc processor. Nothing I personally rely on will ever touch Intel processors. Typing this from my AMD 1950x Threadripper. AMD from here on out for the foreseeable future.
Click to expand...

which Linode plans ? and which Linode data center regions ? You're more likely to get them for newer data center regions that older ones.

BamaStangGuy · Mar 13, 2020

Atlanta. I found that if you do not use Dedicated you are far less likely to get AMD. Dedicated is much more consistent.

Ended up with

Code:

Architecture:          x86_64
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                8
On-line CPU(s) list:   0-7
Thread(s) per core:    1
Core(s) per socket:    1
Socket(s):             8
NUMA node(s):          1
Vendor ID:             AuthenticAMD
CPU family:            23
Model:                 1
Model name:            AMD EPYC 7501 32-Core Processor
Stepping:              2
CPU MHz:               1999.996
BogoMIPS:              4001.65
Hypervisor vendor:     KVM
Virtualization type:   full
L1d cache:             64K
L1i cache:             64K
L2 cache:              512K
L3 cache:              16384K
NUMA node0 CPU(s):     0-7
Flags:                 fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm rep_good nopl cpuid extd_apicid tsc_known_freq pni pclmulqdq ssse3 fma cx16 sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm cmp_legacy cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ssbd ibpb vmmcall fsgsbase tsc_adjust bmi1 avx2 smep bmi2 rdseed adx smap clflushopt sha_ni xsaveopt xsavec xgetbv1 virt_ssbd arat

on dedicated.

eva2000 · Mar 13, 2020

Yeah Linode dedicated plans are more likely to get higher end cpus

Revenge · Mar 13, 2021

Things are going to start getting serious.

Google Publishes "Leaky.Page" Showing Spectre In Action Within Web Browsers

Google's Leaky.Page code shows its possible to leak data at around 1kB/s when running their Chrome web browser on a Skylake CPU. The proof-of-concept code is catering to Intel Skylake CPUs while it should also work for other processors and browsers with minor modifications to the JavaScript. Google was also successful in running this Leaky.Page attack on Apple M1 ARM CPUs without any major changes.
Click to expand...

Google Publishes "Leaky.Page" Showing Spectre In Action Within Web Browsers - Phoronix

Just tried it with chrome and my i5-8400 and the attack is successfully.

In the beginning of this month, a functional Spectre exploit was uploaded to VirusTotal, for Windows and Linux:

Someone was silly enough to upload a working spectre (CVE-2017-5753) exploit for Linux (there is also a Windows one with symbols that I didn't look at.) on VirusTotal last month, so here is my quick Sunday afternoon lazy analysis.

In the case of /etc/shadow, the default option, the content of the file is shoved in memory by running the following command in the background: return system("echo \"whatever\n\" | su - 2> /dev/null"). In my lab, on a vulnerable Fedora, the exploit is successfully dumping /etc/shadow in a couple of minutes.
Click to expand...

Spectre exploits in the "wild"

Google's Leaky.Page PoC is a Spectre V1 gadget that is a JavaScript array that is speculatively accessed out of bounds. While the V1 gadget can be mitigated at the software level, Chrome's V8 team determined that other gadgets such as for Spectre Variant 4 to be "simply infeasible in software" for mitigating.
Click to expand...

It's not possible to mitigate the exploit via software. This is going to be big, and a real problem to all of us.

eva2000 · Mar 14, 2021

Revenge said: ↑

It's not possible to mitigate the exploit via software. This is going to be big, and a real problem to all of us.
Click to expand...

Ouch

Thanks for the heads up!

eva2000 · May 6, 2021

And there's more New Spectre Flaws in Intel and AMD CPUs Affect Billion of Computers

A team of academics from the University of Virginia and University of California, San Diego, have discovered a new line of attack that bypasses all current Spectre protections built into the chips, potentially putting almost every system — desktops, laptops, cloud servers, and smartphones — once again at risk just as they were three years ago.

The disclosure of Spectre and Meltdown opened a floodgates of sorts, what with endless variants of the attacks coming to light in the intervening years, even as chipmakers like Intel, ARM, and AMD have continually scrambled to incorporate defenses to alleviate the vulnerabilities that permit malicious code to read passwords, encryption keys, and other valuable information directly from a computer's kernel memory.

A timing side-channel attack at its core, Spectre breaks the isolation between different applications and takes advantage of an optimization method called speculative execution in CPU hardware implementations to trick programs into accessing arbitrary locations in memory and thus leak their secrets.

"A Spectre attack tricks the processor into executing instructions along the wrong path," the researchers said. "Even though the processor recovers and correctly completes its task, hackers can access confidential data while the processor is heading the wrong way."

The new attack method exploits what's called a micro-operations (aka micro-ops or μops) cache, an on-chip component that decomposes machine instructions into simpler commands and speeds up computing, as a side-channel to divulge secret information. Micro-op caches have been built into Intel-based machines manufactured since 2011.
Click to expand...

eva2000 · Jul 13, 2022

Wow neverending issue meet Retbleed New working speculative execution attack sends Intel and AMD scrambling

Retbleed: New speculative execution attack sends Intel and AMD scrambling | Hacker News

Some microprocessors from Intel and AMD are vulnerable to a newly discovered speculative execution attack that can covertly leak password data and other sensitive material, sending both chipmakers scrambling once again to contain what is proving to be a stubbornly persistent vulnerability.

Researchers from ETH Zurich have named their attack Retbleed because it exploits a software defense known as retpoline, which was introduced in 2018 to mitigate the harmful effects of speculative execution attacks. Speculative execution attacks, including one known as Spectre, exploit the fact that when modern CPUs encounter a direct or indirect instruction branch, they predict the address for the next instruction they’re about to receive and automatically execute it before the prediction is confirmed. Spculative execution attacks works by tricking the CPU into executing an instruction that accesses sensitive data in memory that would normally be off-limits to a low-privileged application. Retbleed then extracts the data after the operation is canceled.
Click to expand...

The ETH Zurich researchers have conclusively shown that retpoline is insufficient for preventing speculative execution attacks. Their Retbleed proof-of-concept works against Intel CPUs with the Kaby Lake and Coffee Lake microarchitectures and AMD Zen 1, Zen 1+, and Zen 2 microarchitectures.
Click to expand...

Spectre variant 2 exploited indirect branches to gain arbitrary speculative execution in the kernel. Indirect branches were converted to returns using the retpoline to mitigate Spectre variant 2.

Retbleed shows that return instructions unfortunately leak under certain conditions similar to indirect branches. These conditions are unfortunately common on both Intel (Skylake and Skylake-based) and AMD (Zen, Zen+ and Zen2) platforms. This means that retpoline was unfortunately an inadequate mitigation to begin with.
Click to expand...

Wow mitigations for RetBleed can have as much as 28% performance penalty!

In response to the research, both Intel and AMD advised customers to adopt new mitigations that the researchers said will add as much as 28 percent more overhead to operations.

Retbleed can leak kernel memory from Intel CPUs at about 219 bytes per second and with 98 percent accuracy. The exploit can extract kernel memory from AMD CPUs with a bandwidth of 3.9 kB per second. The researchers said that it’s capable of locating and leaking a Linux computer’s root password hash from physical memory in about 28 minutes when running the Intel CPUs and in about 6 minutes for AMD CPUs.

Retbleed works by using code that essentially poisons the branch prediction unit that CPUs rely on to make their guesses. Once the poisoning is complete, this BPU will make mispredictions that the attacker can control.

“We found that we can inject branch targets that reside inside the kernel address-space, even as an unprivileged user,” the researchers wrote in a blog post. “Even though we cannot access branch targets inside the kernel address-space—branching to such a target results in a page fault—the Branch Prediction Unit will update itself upon observing a branch and assume that it was legally executed, even if it's to a kernel address.”
Click to expand...

and Chips & Salsa Episode 21: July 2022 Security Advisories - Retbleed

Intel has worked with the Linux community and VMM vendors to provide customers with software mitigation guidance which should be available on or around today's public disclosure date. Note that Windows systems are not affected given that these systems use Indirect Branch Restricted Speculation (IBRS) by default which is is also the mitigation being made available to Linux users. Intel is not aware of this issue being exploited outside of a controlled lab environment.

Intel will release a software security guidance - article titled Return Stack Buffer Underflow RSBU informing software vendors how to mitigate these issues. Customers should review the software security guidance to understand which Intel processors may be affected and available options to enable/disable these mitigations.

Note that in the Intel technical paper titled Retpoline: A Branch Target Injection Mitigation, originally published on 1/3/2018, the issue found by researchers, is called out as a potential risk which we refer to as ‘Empty RSB’.

For these and other Intel security advisories, please visit the Intel Product Security Center.
Click to expand...

Affected Intel cpus seems to go as far back as old Haswell cpus onwards

Refer to the consolidated Affected Processors table (2022 tab, RSBU (RSBA) CVE-2022-29901 and RSBU (RRSBA) CVE-2022-28693 columns) for a list of processors affected by these behaviors.
Click to expand...

eva2000 · Jul 14, 2022

eva2000 said: ↑

Wow neverending issue meet Retbleed New working speculative execution attack sends Intel and AMD scrambling
Click to expand...

Ouch Benchmarking The Linux Mitigated Performance For Retbleed: It's Painful - Phoronix

Yesterday Retbleed was made public as a new speculative execution attack exploiting return instructions. While the "good" news is Retbleed only impacts prior generations of AMD and Intel processors, the bad news is the mitigated performance impact on Linux is quite severe. Since yesterday I have been benchmarking the newly-merged Linux patches on various Intel and AMD processors affected by Retbleed. It's very bad if you are on an affected processor.

The Linux mitigation for Retbleed is invasive at nearly two thousand lines of new code and nearly 400 lines removed, across dozens of files. In the Retbleed whitepaper by ETH Zurich COMSEC researchers, they characterized the mitigations as result in 14~39% overhead. I've been testing the Linux patches out on various systems locally and indeed it's quite severe. The Retbleed mitigations are some of the most performance-wrenching mitigations I've seen in a few years going back to the early Spectre/Meltdown days.
Click to expand...

Worse for AMD Gen 1 cpus

For those wondering, booting the Linux kernel with "mitigations=off" as the universal flag for disabling the mitigations will indeed disable Retbleed mitigations. Or there is now the "retbleed=" kernel parameter where "retbleed=off" can be set if just wanting to disable the new mitigations. The default behavior is "retbleed=auto" for applying the appropriate mitigation based on the CPU. There is also the ability to force certain mitigation behavior too or disabling SMT. For AMD Zen 1 CPUs specifically, disabling SMT is needed for full mitigation but isn't the default behavior.
Click to expand...

eva2000 · Sep 7, 2022

Woah seems RetBleed mitigations really do kill performance for AMD Ryzen Zen 2 processors like 3960X Following Retbleed, The Combined CPU Security Mitigation Impact For AMD Zen 2 / Ryzen 9 3950X - Phoronix

eva2000 · Sep 14, 2022

eva2000 said: ↑

Wow neverending issue meet Retbleed New working speculative execution attack sends Intel and AMD scrambling

Retbleed: New speculative execution attack sends Intel and AMD scrambling | Hacker News
Click to expand...

Looks like RHEL does not have a Kernel fix for RetBleed yet and only posted a mitigation for RHEL8 according to Red Hat response to Retbleed (CVE-2022-29900 / CVE-2022-23816, CVE-2022-29901, CVE-2022-23825) vulnerabilities - Red Hat Customer Portal. RHEL 7 and CentOS 7 like Windows aren't impacted as it already uses Indirect Branch Restricted Speculation (IBRS) mitigation instead of Reptoline mitigation used in RHEL 8's Linux Kernel.

Red Hat Enterprise Linux 7 uses the existing IBRS mitigations for Intel processors.

Red Hat Enterprise Linux 8 can mitigate the flaw in affected Intel CPUs if booted with the kernel parameter: spectre_v2=ibrs

Initial fixes to close this attack vector have been queued in upstream. Red Hat Engineering has these patches currently in testing and will deliver them to the relevant streams.
Click to expand...

But CentOS 7's Linux Kernel says spectre_v2 is using Retpoline but without IBPB?
Code (Text):
find /sys/devices/system/cpu/vulnerabilities -type f -exec bash -c 'echo '---'; echo {}; cat {}' \;
---
/sys/devices/system/cpu/vulnerabilities/mds
Vulnerable: Clear CPU buffers attempted, no microcode; SMT Host state unknown
---
/sys/devices/system/cpu/vulnerabilities/l1tf
Mitigation: PTE Inversion
---
/sys/devices/system/cpu/vulnerabilities/srbds
Not affected
---
/sys/devices/system/cpu/vulnerabilities/itlb_multihit
Processor vulnerable
---
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
Not affected
---
/sys/devices/system/cpu/vulnerabilities/spectre_v1
Mitigation: Load fences, usercopy/swapgs barriers and __user pointer sanitization
---
/sys/devices/system/cpu/vulnerabilities/spectre_v2
Vulnerable: Retpoline without IBPB
---
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass
Vulnerable
---
/sys/devices/system/cpu/vulnerabilities/meltdown
Mitigation: PTI

eva2000 · Oct 23, 2024

Wow still new vulnerabilities are being found New attack methods work against Spectre mitigations in modern PC CPUs | TechSpot

The researchers first found a bug in the microcode for 12th-, 13th-, and 14th-gen Intel Core processors and 5th- and 6th-gen Xeon processors that bad actors could use to invalidate IBPB protection. Spectre flaws leak "secret" data filtered through branch prediction – a type of speculative execution used on modern processors to optimize computing processes and gain significant performance advantages.

Unfortunately, an attacker could theoretically bypass IBPB and still try to abuse Spectre to discover root passwords or other sensitive information. Furthermore, AMD Zen and Zen 2 processors have incorrect implementations of the IBPB protection, making it possible for someone to design a Spectre exploit that leaks arbitrary privileged memory contents, like root password hashes. Zen 3 processors could also be vulnerable, although they only discovered a "faint" signal that wasn't clearly exploitable
Click to expand...

The researchers focused on Spectre exploits working on Linux operating systems since there is no way to obtain Windows or other OS source code. The security team shared details of the security issues with AMD and Intel in June 2024. However, both companies had already discovered the flaws by that time. Chipzilla released a patched microcode in March 2024 (INTEL-SA-00982), and the researchers are now advising PC users to keep their Intel-based systems up-to-date
Click to expand...

eva2000 · Oct 26, 2024

Ah one fixed patch for AMD Zen 5 Linux Fixes "Meltdown Lite" Mitigation Handling On Newer Zen 5 CPUs - Phoronix

Log in / Register

Forums

Get the most out of your Centmin Mod LEMP stack

Security Intel Processor Flaw 'kernel memory leaking' [Spectre & Meltdown]

BamaStangGuy Active Member

eva2000 Administrator Staff Member

BamaStangGuy Active Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Get the most out of your Centmin Mod LEMP stack

Security Intel Processor Flaw 'kernel memory leaking' [Spectre & Meltdown]

BamaStangGuy Active Member

eva2000 Administrator Staff Member

BamaStangGuy Active Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.