Hacker News Reader

Comment by myth_buster | Hacker News Reader

  Intel believes these exploits do not have the potential to corrupt, 
  modify or delete data.

Followed by...

  Check with your operating system vendor or system manufacturer 
  and apply any available updates as soon as they are available.

This press release is a minefield. There are whole paragraphs devoted to say nothing.

View on HN

Somebody please correct me if I'm wrong, but I believe they're basically saying "These exploits do have the potential to read data."

Yep, seems to me they put much work into the statement "the exploits do not have the potential to corrupt, modify or delete data.".

Which leaves open if (that?) reading of data is possible. And as this is not explicitly denied, we have to fear this is exactly what is possible.

There are not saying it explicitly, which they should.

Yeah, sort of "Don't worry I'm not going to shoot you in the torso, arms or legs."

They are - literally the sentence before that states "methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed".

Yes as far as we know it allows user-space code to read kernel memory, but not modify it. It affects Intel but not AMD according to them (not sure why Intel says otherwise).

Details in this blog post from several months ago: https://cyber.wtf/2017/07/28/negative-result-reading-kernel-...

They didn't get it to work but obviously someone else has.

Reply on news.ycombinator.com