Kernel panic! What are Meltdown and Spectre, the bugs affecting nearly every computer and device?

Tech Crunch ^ | 1/3/18 | Devin Coldewey

[palmer]

Is this actually a dangerous exploit or is it hype?

Hype. The exploitation of the flaws requires hostile user mode code. There are claims being kicked around that the user mode code could include javascript but that is BS. Javascript was never able to accomplish rowhammer and won't accomplish this exploit either because it can't run arbitrary instructions.

However if you click on an exe, designed by a hacker, containing instructions to allow kernel memory to be read from user mode, then you are screwed. But you were screwed when you clicked on the exe because it can do plenty of damage in plain old user mode. So it doesn't really matter.

[palmer]

It STILL requires physical access to your Mac to install firmware to exploit this vulnerability

Yes, though technically that firmware fix closes many other doors as well. It is not just for the IPT flaws mentioned in this article.

[palmer]

It STILL requires physical access to your Mac to install firmware to exploit this vulnerability

Yes, though technically that firmware fix closes many other doors as well. It is not just for the IPT flaws mentioned in this article.

[palmer]

But I should have also mentioned that the virtual server providers like Amazon, MS and others are concerned because their users can run arbitrary code by design. A hostile user of one of their services has the potential to impact the service or other users of the service when they should be isolated. So it is not hype for them.

[AllAmericanGirl44]

Bkmk

[conservatism_IS_compassion]

Thanks, SM.

[ShadowAce]

[Buckeye McFrog]

But Y2K was the problem worth throwing billions of dollars at.

[dayglored]

Meltdown and Spectre ... PING!

You can find all the Windows Ping list threads with FR search: just search on keyword "windowspinglist".

Thanks to ShadowAce for the ping!

[Bob434]

[[Bottom line: there are vulnerabilities that are hard-wired into the actual hardware of the computers. This impacts everybody — Apple, Windows, Linux, Android, IOS, everything.]]

The exploits rely on users executing malicious code, right? If the code is windows based (mostly) then how would linux users be affected? (I’m sure some linux codes could be written, but I would think mostly windows code will be written as most people use windows?)

[[And that will take time and will require your hardware to be updated with the new CPU chips.]]

Which —should be— financed by the chipmakers as a recall considering how much money people spent in good faith on processors of a certain speed- only to later find out the speed will be cut by perhaps 30%?

[Dalberg-Acton]

Why WHY did I ever get rid of my Tandy Color Computer??
Motorola 6809 processor is not affected!

[Bob434]

[[However if you click on an exe, designed by a hacker, containing instructions to allow kernel memory to be read from user mode, then you are screwed. But you were screwed when you clicked on the exe because it can do plenty of damage in plain old user mode. So it doesn’t really matter.]]

Suppose that did happen, woudl system restore be able to undo the damage? (There is a program called rollbackRX which is a form of system restore on steroids- it works at boot level before the OS loads, so it could rollback a system to before the malicious code was executed)

[palmer]

That's a great question. A user mode attack will have a lot of trouble persisting because it needs to write stuff to protected system files like the registry and there will be a UAC turning the screen black asking if you want so-and-so program to muck with the registry. Hopefully most people would say no if they were not installing something and expecting that dialog.

However, if you have patched or otherwise do not have this new Intel (perhaps AMD and ARM too) vulnerability, then the user mode malware that you accidentally ran will not be able to bypass UAC or otherwise muck with your system. Therefore you can grab the power cord and yank it out of the wall, and the threat is gone because it can't persist. Being able to persist more easily is just one of the threats from the Intel bug. But it requires malicious code to be running first. The bug does not let hackers in, or create a backdoor, or do anything else to make it easier to initially attack your computer. It only makes things easier after the initial attack is successful.

[TChad]

AMD's Response

Variant One -- Bounds Check Bypass:

Resolved by software / OS updates to be made available by system vendors and manufacturers. Negligible performance impact expected.

Variant Two -- Branch Target Injection:

Differences in AMD architecture mean there is a near zero risk of exploitation of this variant. Vulnerability to Variant 2 has not been demonstrated on AMD processors to date.

Variant Three -- Rogue Data Cache Load

Zero AMD vulnerability due to AMD architecture differences.

I'm not sure what to make of the "near zero risk" for Variant Two.

[TexasGator]

https://www.freerepublic.com/focus/f-chat/3619893/posts