Google reveals CPU security flaw Meltdown and Spectre details

[Eugene]

Related thread: Major flaw in millions of Intel chips revealed

______________________________________________________________________

Source: Slashgear

Google reveals CPU security flaw Meltdown and Spectre details

Chris Davies - Jan 3, 2018

Google has revealed its Project Zero findings on the “speculative execution” security flaws that have sent processor-makers into a tailspin today. The issue – which had initially been circulating as an Intel processor flaw, but which it now appears affects chips from multiple manufacturers – is, in fact, a number of vulnerabilities that exploit critical aspects of many processors since 1995. They’re generally being known as Meltdown and Spectre.

Meltdown is a failure of the isolation between the operating system of a computer, and the user’s applications. A successful attack allows a program to access the memory used by other programs and the OS. That, it’s suggested, could allow a hacker to extract sensitive data being used by other apps.

Spectre, meanwhile, does something similar only between different applications. It’s also based on fundamental flaws in the processors, though researchers say it’s tougher to exploit than Meltdown. Conversely, while there are software patches that effectively block Meltdown attacks, currently it’s far harder to mitigate against Spectre. Indeed, while specific, known exploits can be patched against, that’s not to say there won’t be new variations in future.

Google’s Project Zero researcher, Jann Horn, seemingly identified the speculative execution issues independently to other researchers. According to Google, the issue was initially intended to be disclosed on January 9th, 2018. However, “because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation” it has pulled the trigger early.

-snip-

Read more: https://www.slashgear.com/google-reveals-cpu-security-flaw-meltdown-and-spectre-details-03513512/

[RKP5637]

1. UPDATE! ... almost every modern processor since 1995 is vulnerable to the issues.

Unlike the initial reports suggested about Intel chips being vulnerable to some severe ‘memory leaking’ flaws, full technical details about the vulnerabilities have now been emerged, which revealed that almost every modern processor since 1995 is vulnerable to the issues.

See >>> https://thehackernews.com/2018/01/meltdown-spectre-vulnerability.html

[hunter]

2. In most non-Intel processors it's still a potential vulnerability.

It depends upon the processor's internal algorithms and logic that performs speculative execution.

Basically, Intel has used the same logic and algorithms for speculative execution in its processors for many years now. It worked, it was fast, and they didn't see any reason to change it.

AMD processors are not so uniform. Many of them may indeed be immune to this sort of attack.

ARM processors are unlike any x86 processor, and most ARM processor families don't have this flaw. ARM has been forthcoming about which of its processor families are potentially vulnerable, those that do speculative execution in ways similar to Intel's processors.

The spin coming out of Intel could power a small city.

This is a good example of why diversity is important in any market or natural environment.