Comment by altfredd | Hacker News Reader

Comment by altfredd | Hacker News Reader

Parent Full thread

AMD does not "patch" Spectre. Spectre has to be patched by developers, who execute untrusted code within the trusted address space (e.g. browser and OS developers). I am taking AMD press release to mean, that this "attack" — note how researchers consistently use this word instead of "vulnerability" — is simply proof-of-concept for well known Spectre flaws or possibly even expected behavior of the CPU cache (in non-SMT case).

Many Spectre-type flaws are essentially about an OS process reading/writing it's own memory — which it is naturally expected to have access to. Of course, browser developers weren't prepared for that, but they also were not prepared for gzip-bombs...

I assume, that mitigations [1] suggested by AMD in 2018 are sufficient to protect against this (and all other) Spectre flavors on AMD CPUs, in which case there is really nothing new going on here.

1: https://developer.amd.com/wp-content/resources/90343-B_Softw...

I'm pretty sure the issue with Spectre/Meltdown is about an OS process reading other processes' (or kernel) memory. These are fundamentally chip issues, not developer issues.

See https://googleprojectzero.blogspot.com/2020/02/escaping-chro....

This is a fantastic link, thanks for sharing.

No, Spectre is always about reading your own memory. Your link is about exploiting MDS aka Zombieload — a separate hyper-threading vulnerability, specific to Intel CPUs.

The issue with Meltdown is about an OS process reading other processes' (or kernel) memory - this is caused by the CPU not enforcing its protection boundaries properly and is mitigated by CPU microcode or firmware updates.

The issue with Spectre is about an OS process (or kernel) reading its own memory - this is why in contrast to Meltdown it can't be fully fixed by CPU microcode or firmware updates, it requires mitigation in any code that enforces security boundaries, such as kernels or sandboxing VMs.

There’s about five major spectre classes at this point and they have different mitigation’s. Some are done in the os. Some are done in hardware.

Reply on news.ycombinator.com