- cypherpunks - lists.cpunks.org

Re: [Cryptography] Speculation re Intel HW cockup; reqs. OS rewrites & slow execution
by grarpamp 04 Jan '18

04 Jan '18

On Tue, Jan 2, 2018 at 7:10 PM, Henry Baker <hbaker1(a)pipeline.com> wrote: > FYI -- > > https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/ > > 'Kernel memory leaking' Intel processor design flaw forces Linux, Windows redesign > > Other OSes will need an update, performance hits loom > > By John Leyden and Chris Williams 2 Jan 2018 at 19:29 > > A fundamental design flaw in Intel's processor chips has forced a significant redesign of the Linux and Windows kernels to defang the chip-level security bug. > > Programmers are scrambling to overhaul the open-source Linux kernel's virtual memory system. Meanwhile, Microsoft is expected to publicly introduce the necessary changes to its Windows operating system in an upcoming Patch Tuesday: these changes were seeded to beta testers running fast-ring Windows Insider builds in November and December. > > Crucially, these updates to both Linux and Windows will incur a performance hit on Intel products. The effects are still being benchmarked, however we're looking at a ballpark figure of five to 30 per cent slow down, depending on the task and the processor model. More recent Intel chips have features -- specifically, PCID -- to reduce the performance hit. > > Similar operating systems, such as Apple's 64-bit macOS, will also need to be updated -- the flaw is in the Intel x86 hardware, and it appears a microcode update can't address it. It has to be fixed in software at the OS level, or buy a new processor without the design blunder. > > Details of the vulnerability within Intel's silicon are under wraps: an embargo on the specifics is due to lift early this month, perhaps in time for Microsoft's Patch Tuesday next week. Indeed, patches for the Linux kernel are available for all to see but comments in the source code have been redacted to obfuscate the issue. > > However, some details of the flaw have surfaced, and so this is what we know. > > Impact > > It is understood the bug is present in modern Intel processors produced in the past decade. It allows normal user programs -- from database applications to JavaScript in web browsers -- to discern to some extent the contents of protected kernel memory. > > The fix is to separate the kernel's memory completely from user processes using what's called Kernel Page Table Isolation, or KPTI. At one point, Forcefully Unmap Complete Kernel With Interrupt Trampolines, aka FUCKWIT, was mulled by the Linux kernel team, giving you an idea of how annoying this has been for the developers. > > Whenever a running program needs to do anything useful -- such as write to a file or open a network connection -- it has to temporarily hand control of the processor to the kernel to carry out the job. To make the transition from user mode to kernel mode and back to user mode as fast and efficient as possible, the kernel is present in all processes' virtual memory address spaces, although it is invisible to these programs. When the kernel is needed, the program makes a system call, the processor switches to kernel mode and enters the kernel. When it is done, the CPU is told to switch back to user mode, and reenter the process. While in user mode, the kernel's code and data remains out of sight but present in the process's page tables. > > Think of the kernel as God sitting on a cloud, looking down on Earth. It's there, and no normal being can see it, yet they can pray to it. > > These KPTI patches move the kernel into a completely separate address space, so it's not just invisible to a running process, it's not even there at all. Really, this shouldn't be needed, but clearly there is a flaw in Intel's silicon that allows kernel access protections to be bypassed in some way. > > The downside to this separation is that it is relatively expensive, time wise, to keep switching between two separate address spaces for every system call and for every interrupt from the hardware. These context switches do not happen instantly, and they force the processor to dump cached data and reload information from memory. This increases the kernel's overhead, and slows down the computer. > > Your Intel-powered machine will run slower as a result. > > How can this security hole be abused? > > At best, the vulnerability could be leveraged by malware and hackers to more easily exploit other security bugs. > > At worst, the hole could be abused by programs and logged-in users to read the contents of the kernel's memory. Suffice to say, this is not great. The kernel's memory space is hidden from user processes and programs because it may contain all sorts of secrets, such as passwords, login keys, files cached from disk, and so on. Imagine a piece of JavaScript running in a browser, or malicious software running on a shared public cloud server, able to sniff sensitive kernel-protected data. > > Specifically, in terms of the best-case scenario, it is possible the bug could be abused to defeat KASLR: kernel address space layout randomization. This is a defense mechanism used by various operating systems to place components of the kernel in randomized locations in virtual memory. This mechanism can thwart attempts to abuse other bugs within the kernel: typically, exploit code -- particularly return-oriented programming exploits -- relies on reusing computer instructions in known locations in memory. > > If you randomize the placing of the kernel's code in memory, exploits can't find the internal gadgets they need to fully compromise a system. The processor flaw could be potentially exploited to figure out where in memory the kernel has positioned its data and code, hence the flurry of software patching. > > However, it may be that the vulnerability in Intel's chips is worse than the above mitigation bypass. In an email to the Linux kernel mailing list over Christmas, AMD said it is not affected. The wording of that message, though, rather gives the game away as to what the underlying cockup is: > > AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault. > > A key word here is "speculative." Modern processors, like Intel's, perform speculative execution. In order to keep their internal pipelines primed with instructions to perform, the CPU cores try their best to guess what code is going to be run next, fetch it, and execute it. > > It appears, from what AMD software engineer Tom Lendacky was suggesting above, that Intel's CPUs speculatively execute code potentially without performing security checks. It seems it may be possible to craft software in such a way that the processor starts executing an instruction that would normally be blocked -- such as reading kernel memory from user mode -- and completes that instruction before the privilege level check occurs. > > That would allow ring-3-level user code to read ring-0-level kernel data. And that is not good. > > The specifics of the vulnerability have yet to be confirmed, but consider this: the changes to Linux and Windows are significant and are being pushed out at high speed. That suggests it's more serious than a KASLR bypass. > > Also, the updates to separate kernel and user address spaces on Linux are based on a set of fixes dubbed the KAISER patches, which were created by eggheads at Graz University of Technology in Austria. These boffins discovered [PDF] it was possible to defeat KASLR by extracting memory layout information from the kernel in a side-channel attack on the CPU's virtual memory system. The team proposed splitting kernel and user spaces to prevent this information leak. Their work was reviewed by Anders Fogh, who wrote this interesting blog post in July. > > That article described his attempts to read kernel memory from user mode by abusing speculative execution. Although Fogh was unable to come up with any working proof-of-concept code, he noted: > > My results demonstrate that speculative execution does indeed continue despite violations of the isolation between kernel mode and user mode. > > It appears the KAISER work is related to Fogh's research, and as well as developing a practical means to break KASLR by abusing virtual memory layouts, the team may have proved Fogh right -- that speculative execution on Intel x86 chips can be exploited to access kernel memory. > Shared systems > > The bug will impact big-name cloud computing environments including Amazon EC2, Microsoft Azure, and Google Compute Engine, said a software developer blogging as Python Sweetness in this heavily shared and tweeted article on Monday: > > There is presently an embargoed security bug impacting apparently all contemporary [Intel] CPU architectures that implement virtual memory, requiring hardware changes to fully resolve. Urgent development of a software mitigation is being done in the open and recently landed in the Linux kernel, and a similar mitigation began appearing in NT kernels in November. In the worst case the software fix causes huge slowdowns in typical workloads. > > There are hints the attack impacts common virtualisation environments including Amazon EC2 and Google Compute Engine... > > Microsoft's Azure cloud -- which runs a lot of Linux as well as Windows -- will undergo maintenance and reboots on January 10, presumably to roll out the above fixes. > > Amazon Web Services also warned customers via email to expect a major security update to land on Friday this week, without going into details. > > There were rumors of a severe hypervisor bug -- possibly in Xen -- doing the rounds at the end of 2017. It may be that this hardware flaw is that rumored bug: that hypervisors can be attacked via this kernel memory access cockup, and thus need to be patched, forcing a mass restart of guest virtual machines. > > A spokesperson for Intel was not available for comment. > --- > > Wouldn't this be a good time to think about putting x86 & x86-64 out of everyone's misery? Choice of architecture isn't the problem, there are many arch, make tens more, let them compete, no problem. > Have there been any *clean sheet* architecture designs since the Snowden revelations? However, ever since time the "clean sheet" has not necessarily been something new, that is done every day, but is moreso the model, the never done before, a proper... #OpenFabs , #OpenHW , #OpenSW , #OpenDev ... yet regardless of their deep understanding of how fundamentally impactful and beneficial this will be to the world (including the sub-world of computing itself), everyone still stupidly refuses to even discuss how to make that revolutionary move, let alone actually starting one up for the relatively small amounts of $ needed to do it. So, needlessly, till then, you will continue to get fucked. Oh well, seems you thoroughly enjoy it, time and again. Perhaps that is the problem, you love it so, and know no better. Try learning. > Clearly, Intel was spending so much time implementing backdoors "for management purposes" (wink, wink), that they didn't have time to work on protecting the poor lusers. They're orthagonal, and lusers are of no concern, otherwise they'd let them look at their complete #Open*, but they don't. Not even profit is their love, because that is #Open* available too, to the better of them. No, it's control (over you) that is their love. Thus, you lose, every time.

1 0

ioerror again...
by g2s 04 Jan '18

04 Jan '18

https://twitter.com/chelseakomlo/status/946904128554504192 I've been standing these bozos and bozoettes down, and describing how institutional slander works, and positing such ideas as... So it doesn't happen every time (calling the police). Fact of the matter is for ALL these alleged incidents it didn't happen at all. Look schmuck, I did industrial statistics for a decade and your background doesn't have to be that to see this defies the odds. I just wonder... ...how many of the 'complainants' are involved in tor's UI, and whether they were told their jobs would be threatened if io got his way, focusing on real security instead of becoming the insecure consumer garbage it has become due to focus on a sucker-friendly UI? Rr

2 3

Re: USA: National Security Strategy, Juan's Wet Dream -- OFF-TOPIC (James Donald is a creep)
by Cecilia Tanaka 03 Jan '18

03 Jan '18

On Dec 30, 2017 20:21, <jamesd(a)echeque.com> wrote: On 12/28/2017 07:42 AM, Cecilia Tanaka wrote: > Who will cry for your death, James? Who will miss you? Nobody. > Social Justice Warriors always project. I hear the voice of a woman who has cats instead of children. When you die, no one will notice, and your cats will eat you. I have children, I have grandchildren. You think you have friends, but observe how progressives treat their "friends". When progs die, their cats eat them. Oh, dear... Are you hearing the voice of a woman who has cats instead of children? Are you sure? Another time, like you mentioned a semester ago and also last year? :(( So you are listening really bad and/or imagining things, my poor old James... Tsk, tsk... Evident signals of dementia. :-/ Well, in your age, becoming senile and mixing facts, sounds, and memories is very natural, but I sincerely recommend you to search for some good medical care in 2018, if you can pay for it, of course. Good psychiatrists and otolaryngologists (ENT doctors) are really expensive in your country. Trump f_cked the healthcare pretty well in only one year, didn't he? ;) I do *not* have cats or any pets and already wrote it so many times here that even a senile old man like you could remember. And already said several times why are my reasons for not having children. It was my personal choice and I will never regret it, even loving very, very much children and my never born daughters and sons... I want to protect them of people like you, Zenaan, Trump, of this unfair world, full of hate and stupid prejudices... <\3 Well, in any case, did you already try DNA exams? Considering your "fascinating personality", I bet your children can easily being postman's and milkman's kids, hihihi... :) Well, anyway, having children and grandchildren means absolutely nothing, James. N-O-T-H-I-N-G, do you understand? No real warranty of mourning, drama, and tears. Why do you think they will miss you? Or will sincerely cry for your death? These are a few of all the probabilities to be considered, if you have at least one single active neuron, James. Too hard for you? Oh, poor old man! Let me help you with very simple explanations, something nearby to your intellectual level... :) They probably hate you and/or feel deeply ashamed of being related to someone so odious, bitter, and cruel like you, that always writes hateful texts, full of all kinds of stupid prejudices, and, all the semesters, tries to hurt me mentioning exactly the same things... Aff, you are so repetitive that it probably is an obvious signal of Alzheimer's disease... :(( You always say you have children and grandchildren (I will only believe after receiving all the DNA exams results, haha!!) and that I will be eaten by my inexistent cats because nobody will notice my death, blah, blah... So f_cking what? Why do you think it will hurt me, stupid and limited creature? :-/ I know it's very hard for you, but simply consider the obvious: - I do not care about your opinion. I do not respect you. I do not care about your life or your death, about what you had or have, about what you did or do. You means nothing for me. And just to register it another time, I do not fear my own death. I do really not care about my ending. What I fear, what hurts my heart and soul are my loved ones' deaths, their pains... Loving is much more important than living, even for people like me. I have different grades of love and friendship. Always had, but only this year, I finally learned to make the distinction between real friends and those "friends" who just remember my existence when need a lawyer, my contacts, or my knowledge about some non-public data, meetings, and materials. Some weeks ago, I was the only person in a group of religious studies to accept the hypothesis of dying in that exact moment. Already had a gorgeous life, true love, and true friends... Much music, all kind of readings and people crossed my way, and my life was very fun and interesting for myself. Full of unexpected dramas, certainly, but I had much more joys and sincere happiness than most of the humanity already had and I sincerely thank the Universe, or maybe God, for this beautiful life. <3 I really prefer to die just right now than walking to the East of Eden for all the eternity, never meeting the death, my own end. It's cruel and I cannot believe in a cruel God. You always say you are "Christian". OK, which is your Christian Church, James? There are hundreds of them in the whole world... :P

12 27

This is why American Libertarians must nuke japan again
by juan 02 Jan '18

02 Jan '18

https://www.youtube.com/watch?v=UTkzQ3V7jyg

1 0

Happy New Year, yay!!! :D
by Cecilia Tanaka 01 Jan '18

01 Jan '18

# https://imgur.com/gallery/pmwt5 <https://imgur.com/gallery/pmwt5> Dear All, Wish much happiness, wisdom, health, and serenity, not only in 2018 but in all moments of your lives. <3 Please, take care of yourselves and your loved ones with much tenderness and love. <3 Peace, love, hope, smiles, music, travels, snuggles, hot chocolate, ice cream... Oh, there are so many awesome things to wish you all, haha!! I will end this list before sending a book instead of a simple message, hahaha!! <3 Tender kisses and tight hugs from Brazil, yay! :D Ceci PS: - Yeah, they are my sincere wishes for each one of you. There are people who hate me and people that I consider evil, but everybody deserves a bit of tenderness at least once in a year... Take care, dear all! :) ---------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

3 2

Do you have predictions about 2017?
by Georgi Guninski 01 Jan '18

01 Jan '18

Niels Bohr allegedly said "Predictions are difficult, especially about the future". Do you have predictions about 2017? Being certified optimist, I predict fuckups, fuckups and more fuckups.

13 132

HAPPY NEW YEAR UNITED STATES PRESIDENT DONALD J. TRUMP
by Happy 2018 Yule Year 01 Jan '18

01 Jan '18

Reminder that Shitposter-in-chief and resident cpunk oldfag Donald J. Trump is the sitting president of the UNITED STATES OF AMERICA. [pics related] Joyful Yuletide !

1 0

getting out of the box -
by Zenaan Harkness 01 Jan '18

01 Jan '18

The title is a bit overhyped, but this is just a guy telling his true story. For those who like something interesting, this is a "blow your mind" guy - not for the extreme existentialists, or may be it is :) https://www.youtube.com/watch?v=UGESh8w0nX4 Suppressed Antigravity Technology [FULL VIDEO] (about 1.1 GiB, 1hrs + 40 mins) If anyone has particular recommended references from this guy, I am interested.

1 1

To Serve Man, With Software
by Michalis Kargakis 01 Jan '18

01 Jan '18

https://news.ycombinator.com/item?id=16040390 https://blog.codinghorror.com/to-serve-man-with-software/

1 0

Greg Caton - Psychopathocracy: Criminality is Essential to Govt
by grarpamp 31 Dec '17

31 Dec '17

https://www.youtube.com/watch?v=UbNbQClSIc4 Anarchast interviews author and 'most wanted' Greg Caton, topics include: a thousand year old cancer cure, Psychopathocracy, good government is an oxymoron, negaprocity vs cooperation, Anarchy as a science, in the absence of anarchy you get planetary destruction, government is an unnatural parasite, deep seated corruption is the norm for government, ecological stress, environmental degradation, heading towards a lifeless planet, we have passed a tipping point, life is a fragile gift, government driven destruction, good government is impossible, the tyranny of good intentions, the masses of beneficiaries of corruption, Anarchapulco 2018.

2 1