Welcome to DU! The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards. Join the community: Create a free account Support DU (and get rid of ads!): Become a Star Member Latest Breaking News Editorials & Other Articles General Discussion The DU Lounge All Forums Issue Forums Culture Forums Alliance Forums Region Forums Support Forums Help & Search

Eugene

(62,741 posts)
Wed Jan 3, 2018, 07:56 PM Jan 2018

Google reveals CPU security flaw Meltdown and Spectre details

Related thread: Major flaw in millions of Intel chips revealed

______________________________________________________________________

Source: Slashgear

Google reveals CPU security flaw Meltdown and Spectre details

Chris Davies - Jan 3, 2018

Google has revealed its Project Zero findings on the “speculative execution” security flaws that have sent processor-makers into a tailspin today. The issue – which had initially been circulating as an Intel processor flaw, but which it now appears affects chips from multiple manufacturers – is, in fact, a number of vulnerabilities that exploit critical aspects of many processors since 1995. They’re generally being known as Meltdown and Spectre.

Meltdown is a failure of the isolation between the operating system of a computer, and the user’s applications. A successful attack allows a program to access the memory used by other programs and the OS. That, it’s suggested, could allow a hacker to extract sensitive data being used by other apps.

Spectre, meanwhile, does something similar only between different applications. It’s also based on fundamental flaws in the processors, though researchers say it’s tougher to exploit than Meltdown. Conversely, while there are software patches that effectively block Meltdown attacks, currently it’s far harder to mitigate against Spectre. Indeed, while specific, known exploits can be patched against, that’s not to say there won’t be new variations in future.

Google’s Project Zero researcher, Jann Horn, seemingly identified the speculative execution issues independently to other researchers. According to Google, the issue was initially intended to be disclosed on January 9th, 2018. However, “because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation” it has pulled the trigger early.

-snip-


Read more: https://www.slashgear.com/google-reveals-cpu-security-flaw-meltdown-and-spectre-details-03513512/
2 replies = new reply since forum marked as read
Highlight: NoneDon't highlight anything 5 newestHighlight 5 most recent replies
Google reveals CPU security flaw Meltdown and Spectre details (Original Post) Eugene Jan 2018 OP
UPDATE! ... almost every modern processor since 1995 is vulnerable to the issues. RKP5637 Jan 2018 #1
In most non-Intel processors it's still a potential vulnerability. hunter Jan 2018 #2

RKP5637

(67,112 posts)
1. UPDATE! ... almost every modern processor since 1995 is vulnerable to the issues.
Thu Jan 4, 2018, 10:43 AM
Jan 2018
Unlike the initial reports suggested about Intel chips being vulnerable to some severe ‘memory leaking’ flaws, full technical details about the vulnerabilities have now been emerged, which revealed that almost every modern processor since 1995 is vulnerable to the issues.


See >>> https://thehackernews.com/2018/01/meltdown-spectre-vulnerability.html

hunter

(39,011 posts)
2. In most non-Intel processors it's still a potential vulnerability.
Thu Jan 4, 2018, 11:47 AM
Jan 2018

It depends upon the processor's internal algorithms and logic that performs speculative execution.

Basically, Intel has used the same logic and algorithms for speculative execution in its processors for many years now. It worked, it was fast, and they didn't see any reason to change it.

AMD processors are not so uniform. Many of them may indeed be immune to this sort of attack.

ARM processors are unlike any x86 processor, and most ARM processor families don't have this flaw. ARM has been forthcoming about which of its processor families are potentially vulnerable, those that do speculative execution in ways similar to Intel's processors.

The spin coming out of Intel could power a small city.

This is a good example of why diversity is important in any market or natural environment.

Latest Discussions»Help & Search»Computer Help and Support»Google reveals CPU securi...