Hacker News Reader

Comment by dragontamer | Hacker News Reader

Spectre affects all advanced chips with out-of-order execution.

But Spectre cannot break kernel memory. Its more of a "new class" of bug, similar to how "Buffer Overflows" don't describe a particular attack, but a methodology that hackers will use to exploit new bugs.

Spectre affects virtually every high-performance computer in the world. Smartphones, SPARC, PowerPC, Intel, AMD, ARM. All of these designs use out-of-order execution, and in theory, a rogue Javascript would be able to read the rest of process memory if a programmer isn't careful about how things work.

Meltdown took it one step further: and showed that code could read Kernel memory. That was an Intel-specific mistake.

View on HN

Meltdown didn't exclusivly effect Intel, Apple has stated that some iOS and tvOS devices were affected by Meltdown.

https://support.apple.com/en-us/HT208394

No, Spectre breaks (reads) kernel memory too, and the authors are explicit about this in their paper.

It allows you to attack any security domain you can "call out" on the local host, whether it is some other process, another security domain in the same process (e.g., a JIT running JavaScript) or the kernel.

The authors used JavaScript and cross-Hyperthread/process disclosures as their primary examples probably because at leas the former is especially devastating given the ease of running JavaScript remotely when someone visits a malicious website, and because it differentiates it from Meltdown (which is mostly only about reading kernel memory) - but executing either variant is even easier against kernel syscalls (no need to attack across the JIT layer).

The huge amount of work been done on kernels to mitigate Spectre is evidence of this.

> Spectre affects all advanced chips with out-of-order execution.

It's not out-of-order execution, it's speculative execution (all forms of branch prediction) plus the ability to affect the cache state during speculative execution.

I'd be surprised if there was an out-of-order CPU that didn't do speculative executions. I mean, a major benefit of OOE is to fill up the pipelines / execution units, and speculative execution is a very "obvious" way to do that.

All advanced architectures with chips in use have chips that use some form of OOE, but not necessarily all chips of all advanced architectures. Quite a lot of smartphone ARM chips do not use OOE.

Cortex R-series and A-series chips seem to be affected. What ARM chips are not affected come from the M-series line. What smartphones use those, or an equivalent permutation?

EDIT: Having done a little reading, I can't find an instance of a notable (even marginally so) smartphone using an M-series chip.

Yeah, M-Series aren't made for things like smartphones. They're primarily IoT and Automotive focused, and the M0 and M0+ variants are positioned as 8 and 16-bit microcontroller replacements. Vendors typically don't add DDR SDRAM controllers to their implementations of M-Series cores, so memory is limited to SDR, which would be too small and too slow for a smartphone. Processor speed is also too slow - generally in the 10s to few hundreds of MHz range, with ~300MHz being the fastest for the relatively high-performance Cortex M7.

Cortex A53 and A55 (in-order designs) are not vulnerable to any variant. ARM Ltd. provide details for all of their designs (it's a bit like Swiss cheese, each core is vulnerable to different variants). Thus low/mid-tiers and half of cores in big.LITTLE configuration are safe. The worst is latest gen, Cortex A75, which is vulnerable to all of variants (incl. Meltdown).

It's all in ARM Ltd. report and whitepaper.

There are plenty of ARM chips that do not implement OOE.

M-series cores and some R-series cores don't implement OOE or branch prediction, so they are proof against Spectre, but they are used in embedded systems and are largely slow. A-series cores are used in phones. All the ones in current use are vulnerable to Spectre.

M-series cores are not affected, but the M4 and M7 cores do implement branch prediction (you're correct that they don't do OOE).

See http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc....

>>Instruction prefetch and branch prediction >> >>The Cortex-M4 processor:

    >> prefetches instructions ahead of execution

    >> speculatively prefetches from branch target addresses.

Most of the lower-end and lower-power A-series cores are in-order and are not affected by Spectre. Low to mid end smartphones aren't generally going to be affected.

Reply on news.ycombinator.com