Re:Reading privileged memory with a side-channel
by ethbro on Wednesday January 03, 2018 @07:36PM
(#16066906)
My read is that vulnerable processors generally have to:
1. Have out of order execution
2. Have aggressive speculative memory load / caching behavior
3. Be able to speculatively cache memory not owned by the current process (either kernel or otherwise)
4. Have deterministic ways of triggering a speculative load / read to the same memory location
2 is probably the saving grace in ARM / low power land, given they don't have the power budget to trade speculative loads for performance (in the event they're even out of order in the first place).
Caveat: I'm drinking pretty strong Belgian beer while reading through these papers.
> AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault.
And Axios [2] that Zdnet quotes gave a comment from AMD:
> "To be clear, the security research team identified three variants targeting speculative execution. The threat and the response to the three variants differ by microprocessor company, and AMD is not susceptible to all three variants. Due to differences in AMD's architecture, we believe there is a near zero risk to AMD processors at this time. We expect the security research to be published later today and will provide further updates at that time."
And a comment from ARM: > Please note that our Cortex-M processors, which are pervasive in low-power, connected IoT devices, are not impacted.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/...
[2] https://www.axios.com/how-the-giants-of-tech-are-dealing-wit...