Author Topic: Meltdown and Spectre: Every modern processor has unfixable security flaws  (Read 5195 times)

Varti

  • Administrator
  • Hero Member
  • *****
  • Posts: 1266
    • View Profile
ArsTechnica has published an article on the two recently discovered flaws which plague every modern CPU:

https://arstechnica.com/gadgets/2018/01/mel...security-flaws/

Thanks to SMD for mentioning the news on Indiegogo.

Varti
« Last Edit: January 05, 2018, 04:01:35 am by Varti »
Planet Gemini PDA WiFi/LTE with Mediatek x27
SL-C1000 running Arch Linux ARM May2017, K30225 Wi-Fi CF Card, 64GB SDXC card
and many other Zauruses!

HoloVector

  • Hero Member
  • *****
  • Posts: 533
    • View Profile
    • http://
Meltdown and Spectre: Every modern processor has unfixable security flaws
« Reply #1 on: January 05, 2018, 08:51:56 am »
This issue still seems to be a moving target as there is some conflicting info coming out. Intel hasn’t been very forth coming at all with the extent this affects their product line (could affect all processors going back to 1995 or not). AMD is not/is affected.  ARM is only affected in a small subset of their Cortex processors but, are they ignoring their older models like StrongARM?Basically, it is a real mess.  
I think I'm coming down with what kahm's got!  I now have 3 Zaurii in house!  ;)
Current: Zaurus SL-C3200 -  Bobby (Configuring pdaXii13 Akita with Full 5.4.9 upgrade running IceWM)
Zaurus SL-C1000 - Hachiko (Configuring Cacko 1.23 with evilJazz's new kernel)
Zaurus SL-C860 - Fett (Customized Cacko 1.23 with handmade Boba Fett Theme)
Symbol WiFi CF card|Buffalo WiFi CF Card|Buffalo Ethernet CF Card|Red Piel Frama Case|PDAir Case|Black Pelican 1020 Case|Pentopia Stylii|SaruTek Protectors|Transcend SDs (4GB 150X, 1GB 80X, 256MB 45X, 128MB 45X)|2GB PNY SD|2GB SanDisk SD|Transcend CFs (1GB 80X, 512MB 80X)|Sandisk CFs (4GB, 512MB, 256MB)|256MB Netac USB-CF|RH-1 Remote
Check out the ScummVM@tyrannozaurus page if you are an "adventurer" type of person.

Varti

  • Administrator
  • Hero Member
  • *****
  • Posts: 1266
    • View Profile
Meltdown and Spectre: Every modern processor has unfixable security flaws
« Reply #2 on: January 05, 2018, 08:59:33 am »
I hope that both Gemini's Planet Computers and GPD will be able to confirm if the CPUs they use are affected or not by these two bugs.

Varti
Planet Gemini PDA WiFi/LTE with Mediatek x27
SL-C1000 running Arch Linux ARM May2017, K30225 Wi-Fi CF Card, 64GB SDXC card
and many other Zauruses!

greguu

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 433
    • View Profile
    • http://github.com/greguu
Meltdown and Spectre: Every modern processor has unfixable security flaws
« Reply #3 on: January 06, 2018, 04:00:29 am »
There is a lot of confusion going on at the moment and I agree, the official communication from Intel was very misleading. Even popular online IT outlets struggle to get the story straight and can not separate clearly the cause and impact of "Meltdown" vs "Spectre". This is quite frustrating.

Intel Atom (x86):

Any Atom CPUs before 2013 should be fine. Any newer ones are affected from Meltdown and Spectre AFAIK. Take this with a grain of salt, if you like to know for sure, compile and run these source files on your Atom based Hand Held:
Spectre.c https://gist.github.com/Badel2/ba8826e66072...26c5ed098d98d27
Meltdown.c https://github.com/paboldin/meltdown-exploit

Intel Xscale (Zaurus Series, PXA2xx):

There is strong indication that Meltdown does not apply to PXA2xx, but currently this can not be confirmed 100% as the meldown.c files circulating on github do rely on X86. If you have a proof of concept .c file for ARMv5, let me know.
The same applies for Spectre. The Raspberry Pi seems not be be affected (ARMv7+), but Xscale ARMv5 cores (older) do actually have proper dynamic branch prediction/folding as opposed to some ARMv7 cores AFAIK. It may be possible to exploit PXA2xx with Spectre (this may need a specific approach), but because current Spectre.c files on github do not compile on ARM due to a SSE specific  "_mm_clflush" this can not be confirmed at this stage.

Please note that none of the released linux kernels working with ArchLinuxARM for the Zaurus Cxx00 Series does feature Kernel Page Table Isolation (KPTI). This feature may be implemented in a newer kernel release for ALARMZ. (4.16)

Gemini PDA:

This is platform is interesting, as the chip used, a MediaTek,  seems to use a few different ARM cores. The Cortex A72  is affected from spectre but he Cortex A53 is apparently not. According to the spec sheet the Gemini PDA CPU consists of:

2x Cortex A72 @2.6GHz
4x Cortex A53 @2.0GHz
4x Cortex A53 @1.6GHz

so there may be some impact via the primary 2 core Cortex A72 I would assume.

Quote from: HoloVector
This issue still seems to be a moving target as there is some conflicting info coming out. Intel hasn’t been very forth coming at all with the extent this affects their product line (could affect all processors going back to 1995 or not). AMD is not/is affected.  ARM is only affected in a small subset of their Cortex processors but, are they ignoring their older models like StrongARM?Basically, it is a real mess.  
« Last Edit: January 06, 2018, 05:49:44 am by greguu »
Gemini-PDA (Sailfish X and Android) / LG Nexus 5 (Android 11) / Nokia N9 (MeeGo/Harmattan)
Sharp Zaurus C3100 (Borzoi) - Void Linux (voidz) Kernel 5.0.0 - Hardware (Buffalo CF LAN, DLink 660 CF WiFi, ASIX AX88772 USB Ethernet)

Varti

  • Administrator
  • Hero Member
  • *****
  • Posts: 1266
    • View Profile
Meltdown and Spectre: Every modern processor has unfixable security flaws
« Reply #4 on: January 08, 2018, 10:43:01 am »
Quote from: greguu
There is a lot of confusion going on at the moment and I agree, the official communication from Intel was very misleading. Even popular online IT outlets struggle to get the story straight and can not separate clearly the cause and impact of "Meltdown" vs "Spectre". This is quite frustrating.
Thanks greguu for this write up, it was an interesting read. For the XScale CPU, maybe the folks on the Arm Linux ARM forum will make a compatible version of both tools.

Varti
Planet Gemini PDA WiFi/LTE with Mediatek x27
SL-C1000 running Arch Linux ARM May2017, K30225 Wi-Fi CF Card, 64GB SDXC card
and many other Zauruses!

HoloVector

  • Hero Member
  • *****
  • Posts: 533
    • View Profile
    • http://
Meltdown and Spectre: Every modern processor has unfixable security flaws
« Reply #5 on: January 15, 2018, 09:55:22 pm »
Any more news on the PXA-2xx in the Zaurii?
I think I'm coming down with what kahm's got!  I now have 3 Zaurii in house!  ;)
Current: Zaurus SL-C3200 -  Bobby (Configuring pdaXii13 Akita with Full 5.4.9 upgrade running IceWM)
Zaurus SL-C1000 - Hachiko (Configuring Cacko 1.23 with evilJazz's new kernel)
Zaurus SL-C860 - Fett (Customized Cacko 1.23 with handmade Boba Fett Theme)
Symbol WiFi CF card|Buffalo WiFi CF Card|Buffalo Ethernet CF Card|Red Piel Frama Case|PDAir Case|Black Pelican 1020 Case|Pentopia Stylii|SaruTek Protectors|Transcend SDs (4GB 150X, 1GB 80X, 256MB 45X, 128MB 45X)|2GB PNY SD|2GB SanDisk SD|Transcend CFs (1GB 80X, 512MB 80X)|Sandisk CFs (4GB, 512MB, 256MB)|256MB Netac USB-CF|RH-1 Remote
Check out the ScummVM@tyrannozaurus page if you are an "adventurer" type of person.

greguu

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 433
    • View Profile
    • http://github.com/greguu
Meltdown and Spectre: Every modern processor has unfixable security flaws
« Reply #6 on: January 20, 2018, 10:25:33 pm »
According to "Toradex", a Swiss ARM SOC company, PXA-27x are not affected by meltdown or spectre. If this is true, this possibly also applies to PXA-25x. I am still looking for a proof of concept spectre.c or meltdown.c that compiles on a Cxx00.

https://www.toradex.com/news/vulnerability-...wn-and-spectre# (Released Friday, January 19, 2018 )
Quote from: HoloVector
Any more news on the PXA-2xx in the Zaurii?
« Last Edit: January 24, 2018, 03:24:09 am by greguu »
Gemini-PDA (Sailfish X and Android) / LG Nexus 5 (Android 11) / Nokia N9 (MeeGo/Harmattan)
Sharp Zaurus C3100 (Borzoi) - Void Linux (voidz) Kernel 5.0.0 - Hardware (Buffalo CF LAN, DLink 660 CF WiFi, ASIX AX88772 USB Ethernet)