Hacker News Reader

Comment by alsadi | Hacker News Reader

Why you single intel on this, ARM and POWER also affected

https://www.ibm.com/blogs/psirt/potential-impact-processors-...

Everyone is affected by Spectre, but my understanding is that Meltdown is a particularly powerful "version" of Spectre that only affects Intel CPUs ?

from what I understand AMD and ARM are also affected by the toy POC, quote

Out-of-order execution is an indispensable performance feature and present in a wide range of modern processors.

quote

However, for both ARM and AMD, the toy example as described in Section 3 works reliably, indicating that out-of-order execution generally occurs and instructions past illegal memory accesses are also performed

end of quote

it just need more work to make it work their

https://meltdownattack.com/meltdown.pdf

I saw some speculation that AMD might raise the kernel memory read exception earlier than Intel which prevents any subsequent instructions from using the value fetched from the kernel address space.

Having just read the Meltdown paper, but not the Spectre paper. My understanding is that yes Meltdown is much easier to exploit and more powerful. I believe Spectre requires the attacker to consistently fool the branch predictor while Meltdown enables reading kernel memory mapped into user space process via access in speculatively executed code and observing the affects on the CPU cache.

Spectre involves finding some code in the kernel that has access to the data, and getting it to access it speculatively before the conditional that tells it not to is evaluated.

Meltdown involves crafting some code yourself that speculatively accesses data it does not have access to before the CPU rejects the access due to permissions.

In other words, Meltdown involves your code accessing the data, but Spectre involves getting the kernel to do it for you. Spectre is a neat clever side-channel attack that is hard to protect against, while Meltdown is a blundering error in the way the CPU works.

My ELI5 attempt:

There are 3 vulnerabilities.

Meltdown is 1 of the 3. Meltdown is pretty much Intel only. Some ARM SoCs are also affected, but these are relatively rare. AMD64 is unaffected by Meltdown.

Spectre are the other 2 vulnerabilities. Spectre affects pretty much everyone.

Meltdown is more severe, and more of a blunder.

For a technical explanation, see [1]. Was recently referred to at HN as well.

[1] https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne...

Do you have any source on why AMD64 is unaffected? The paper only mentions that they couldn't make their current approach work on AMD, but it doesn't rule out that it could be improved and made work

AMD's microarchitecture does not perform speculative loads that would cause a segfault, according to this AMD engineer:

https://lkml.org/lkml/2017/12/27/2

> We also tried to reproduce the Meltdown bug on several ARM and AMD CPUs. However, we did not manage to successfully leak kernel memory with the attack de- scribed in Section 5, neither on ARM nor on AMD. The reasons for this can be manifold. First of all, our im- plementation might simply be too slow and a more opti- mized version might succeed. For instance, a more shal- low out-of-order execution pipeline could tip the race condition towards against the data leakage. Similarly, if the processor lacks certain features, e.g., no re-order buffer, our current implementation might not be able to leak data. However, for both ARM and AMD, the toy example as described in Section 3 works reliably, indi- cating that out-of-order execution generally occurs and instructions past illegal memory accesses are also per- formed.

From the Meltdown paper[0] section 6.4 it would seem that out of order execution referencing illegal memory locations still occurs unless of course I'm misunderstanding something.

0: https://meltdownattack.com/meltdown.pdf

The section 3 toy example is demonstrating that OOO execution can cause instructions after a faulting instruction to be speculatively executed, but in that example the subsequent instructions do not depend on the result of the faulting instruction.

AMD's claim is that the result of the faulting instruction can never end up affecting a later speculated instruction - ie, for Intel the bad access says "here's the value you asked for" and later says "actually you don't have permission, forget you saw that". For AMD the bad access says "you don't have permission, so no result available"

Thanks for the explanation. So it's down to when the access check is performed. I wonder why Intel did it the way they did, performance maybe?

In terms of ARM, only some of the ARM CPUs are affected. The CPUs used in the Raspberry Pi range don't have out of order execution, so aren't affected.

Reply on news.ycombinator.com