News for hackers. Stuff that matters.
Re:Zenbleed by distcs on Tuesday July 25, 2023 @04:47AM (#36859663)
Why do comments like this just make a bold claim and then wander off as if the claim stands for itself? No explanation. No insight. I mean why should we just take your word for it?

I'd like to be educated here why a big switch statement wouldn't necessarily protect us from these CPU vulnerabilities? Anyone willing to help?

Re:Zenbleed by yakubin on Tuesday July 25, 2023 @07:43AM (#36860883)
The question should rather be: why would it protect you? This switch statement also runs on a CPU, which is still vulnerable. This CPU still speculates the execution of the switch statement. No amount of software will make hardware irrelevant.
Re:Zenbleed by etmmte on Wednesday July 26, 2023 @03:04AM (#36874029)
You need certain instruction to exploit the vulnerability, if the switch statement doesn't use that then it is safe.
Re:Zenbleed by eru on Wednesday July 26, 2023 @09:21AM (#36877234)
Hence my choice of phrasing: 'wouldn't necessarily protect you'.

So, yes, the switch statemement might be safe, but you would need to prove that your switch statement doesn't use those instructions. You don't get to claim that for free just because you are using a switch-statement.

Conversely, even if you execute bare metal instructions for the user of the VM, you could also deny those instructions to the user. Eg by not allowing self-modifying code, and statically making sure that the relevant code doesn't contain those instructions.

So the switch statement by itself does not do anything for your security.

Re:Zenbleed by MauranKilom on Wednesday July 26, 2023 @04:20PM (#36884367)
Tangent: To deny those bare-metal instructions with static analysis, you might also have to flat out deny certain sequences of instructions that, when jumped to "unaligned" would also form the forbidden instruction. That might break innocent programs, no?
Re:Zenbleed by eru on Thursday July 27, 2023 @09:03AM (#36892788)
Simple: don't allow unaligned jumps. Google's NaCl already figured out how to do that ages ago. (Eg you could only allow jumps after a bit-masking operation. Details depends on architecture.)

But yes, unless you solve the halting problem, anything that bans all bad programs will also have false positives. It's the same with type systems in programming languages.