Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The effect on Intel is far more severe than on other architectures. There were three vulnerabilities, two grouped together as "spectre" and one called "meltdown." Intel products are uniquely vulnerable to the meltdown attack, while many CPUs are vulnerable to spectre. The summary AFAIUI is that for most CPUs you can attack userspace processes with these techniques (think Javascript running in a browser), while for Intel CPUs you can also attack the kernel. Intel CPUs also seem to be somewhat easier to attack than others because of a higher-bandwidth side channel.


> Intel products are uniquely vulnerable to the meltdown attack

More precisely, there is only a PoC for Intel at this time. AMD processors are believed to not be vulnerable. Some ARM processors _are_ believed to be vulnerable.

> for most CPUs you can attack userspace processes with these techniques

Spectre can attack the kernel as well, at least according to http://www.tomshardware.com/news/meltdown-spectre-exploits-i... . It's just harder to use than meltdown.


That link no longer loads for me.

AIUI, Spectre can be used to attack the kernel, only if you can get code running in kernel-space, via, e.g. eBPF.


No, you could also find a gadget with ROP techniques. The eBPF thing in the paper was purely due to convenience of exploitation.


I think that's almost but not quite exactly right.

Spectre variant 2 attacks vulnerable indirect jump code patterns that exist in the kernel (or some other process), but doesn't require running the attacker's code.

Spectre variant 1 allows you to infer the contents of memory in the same address space, so that's the one where you'd use eBPF to attack the kernel.

Meltdown (variant 3) if I understand correctly can infer memory contents of other address spaces without relying on any assumptions about the code running in the other address space.

https://security.googleblog.com/2018/01/more-details-about-m...


> That link no longer loads for me.

Oh, right, ycombinator's URL parser is broken. I fixed the link to work around the buggy parser....


I'm curious about AMD not being vulnerable, mostly because this page: https://www.kb.cert.org/vuls/id/584653 makes me think that AMD has admitted to being vulnerable.


That page talks about both Meltdown and Spectre, as far as I can tell. AMD is vulnerable to Spectre; everyone agrees on that. According to https://www.amd.com/en/corporate/speculative-execution AMD claims it's not vulnerable to Meltdown (aka "Variant Three").


See this mailing list post https://lkml.org/lkml/2017/12/27/2


A minor correction, ARM's upcoming A75 core looks like it will be vulnerable to Meltdown too. But since it isn't intended for use on server workloads the performance impact of the fix shouldn't be very significant.


I did not realize that Intel CPU's also open up the kernel to the Spectre attack, while others don't. That's noteworthy.


"(at least for the spectre attack)"




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: