Undocumented x86 instructions to read/ write microcode | Hacker News Reader

Undocumented x86 instructions to read/ write microcode

twitter.com

79 pointstomcam16 comments

Not enough characters allowed in HN title to explain that it requires Intel hardware to execute, sorry.

I believe the point here is this: now that the hacker community knows about these opcodes, they can now focus on other ways to access the functionality.

Yes, you currently need Intel equipment to access this functionality today, but its quite probable that some innocuous function on the CPU itself can be used to gain access.

I mean who would have thought just reading and writing memory you already have access to could be used to exfiltrate system secrets? (Riwhammer)

Could a case be made against using x86 based on it’s fragility from a security perspective? I imagine since ARM is not fully closed (EDIT: ARM is not oss) they don’t have this problem, although I suppose there’s nothing stopping Apple from “extending” the design by adding extra op codes is there? (genuine question).

ARM is OSS?

ARM is commercial, but yes, there is nothing that stops Apple from modifying the base ARM spec (and afaik they already have).

Your last point is why I don't really see the hype over RISC-V from an end-user perspective. Companies manufacturing RISC-V processors are free to add whatever private extensions (or backdoors) they want. And unlike software, you can't easily reverse engineer it to discover them.

RISC-V certainly doesn’t prevent this kind of thing but it does at least provide the opportunity for this kind of behavior to be challenged. Given anyone is free to manufacture a RISC-V processor it’s at least feasible another company could step in and provide a product that doesn’t do these things if that’s what the market demands.

https://news.ycombinator.com/item?id=27764806 (46 comments)

Somewhat like the 10,000 chimpanzees on typewriters, I would not at all be surprised that the PLA has researched undocumented instructions and/or exfiltrated the documentation.

Security by obscurity presumes that lack of resources precludes hackers from finding backdoors.

It's a such a great backdoor that you can't use it unless you have total access to Intel's security infrastructure.

Whenever starting Linux I see a statement like “applying cpu microcodes”. So it seems the pathway to write microcodes is well known. I also recall some windows app circulating in the Hackintosh community to patch your Intel cpu to make it behave as macOS expects in some cases.

What is new about this?

In this case digital signature is not required (unlike official microcode update instructions), I guess. Otherwise there's no news.

This is not notable. Of course there exist instructions that are used to update microcode. It would only be notable if you could execute them as an end costumer, which you can't.

There are apparently exploits against Intel ME on some platforms that do indeed allow executing these instructions as an end consumer.

Link?

https://github.com/chip-red-pill/IntelTXE-PoC

Reply on news.ycombinator.com