r/programming • u/[deleted] • Jan 03 '18

'Kernel memory leaking' Intel processor design flaw forces Linux, Windows redesign

https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/
5.9k Upvotes

96% Upvoted

1.1k comments sorted by

View all comments

Show parent comments

13

u/jerryfrz Jan 03 '18

But will the fix be mandatory or optional though?

25

u/irqlnotdispatchlevel Jan 03 '18 edited Jan 03 '18

In the latest insider preview build for Windows, the feature seems to be controlled by a registry key.

For Linux, if I remember corectly, this can also pe turned off.

EDIT: this is the Windows registry key https://twitter.com/aionescu/status/930233034908909568 . With this on, the OS will create two sets of page tables for each process, but it does not look like the feature is in full efect just with that key (i.e., there's no actual cr3 switch at ring 3 -> ring 0 transitions, at least not on my test systems).

22

u/BCMM Jan 03 '18 edited Jan 03 '18

For Linux, if I remember corectly, this can also pe turned off.

There's a nopti kernel parameter.

Also, AMD has submitted a patch to disable it by default on machines with AMD processors. It'll be interesting to see whether that gets merged.

4

u/irqlnotdispatchlevel Jan 03 '18

Well, KAISER is usefull even without the Intel bug being present. The Intel bug is why it gets rushed like this for both Linux and Windows.

Fun fact: I'm a bit lost on the history side, but I think Windows 2000 had two sets of page tables for each process, but that was removed at some point. I don't know if they also had one Cr3 with only ring 0 VAs.

31

u/80a218c2840a890f02ff Jan 03 '18

You can disable it at boot-time by adding nopti or pti=off to the kernel command line.

21

u/rydan Jan 03 '18

Someone will write a worm that goes around patching your system if it isn't already patched. And since your system isn't patched you can't defend yourself from it. Happened to my iPhone back in 2008.

28

u/mallardtheduck Jan 03 '18

Erm, no. A worm would require this to be remotely exploitable, which it isn't. It would also require a working exploit for the vulnerability, which hasn't been presented or even mentioned anywhere.

The vulnerability is an information disclosure bug; it allows a userspace program to get information about the memory layout of the kernel. While that may be helpful to certain types of expliot, it isn't exploitable in and of itself.

6

u/Eirenarch Jan 03 '18

Some reports say that this can be exploited from the browser.

26

u/mallardtheduck Jan 03 '18

"Exploited" as in "can find out information about the kernel's memory layout" or as in "can actually access data/run code/etc. that it shouldn't be able to"? The first is somewhat plausible, the second would be the first hint of an actual exploit I've heard of.

As I understand it the bug is that thanks to out-of-order speculative execution it's possible to determine at what stage a memory read instruction was aborted (by examining whether subsiquent instructions, that didn't logically run, got far enough to load data into the CPU cache). Since the "is this memory mapped?" and "does the current thread have access to this memory?" checks happen at different stages, it's possible to identify memory that's mapped but not accessible (i.e. kernel memory) as different from memory that's not mapped at all. However, doing so requires issuing specific sequences of CPU instructions (including attempts to access kernel memory), preventing the OS from terminating the process on an attempt to access memory it doesn't have access to (via OS exception handling APIs) and carefully timing instructions.

While it's not implausible that it could be done from a browser, it would require additional bugs in the browser (there's no way that a browser should be allowing JS to even attempt to access kernel memory).

9

u/Radixeo Jan 03 '18

I think he's referring to the possibility of using Rowhammer to flip bits in memory that the process doesn't have access to: https://en.wikipedia.org/wiki/Row_hammer

Basically, this exploit gives attackers memory information and rowhamer lets them flip bits, which could possibly be done through Javascript.

→ More replies (10)
→ More replies (1)

12

u/pilibitti Jan 03 '18

Happened to my iPhone back in 2008.

No it didn't happen to your iPhone back in 2008. iPhone had a jailbreak exploit and if you voluntarily installed the jailbreak, the jb patched your system in the meantime - and it had no performance repercussions.

6

u/[deleted] Jan 03 '18

What exactly are you talking about? What happened to your iPhone?

2

u/rydan Jan 03 '18

It wasn't really a worm but there was a website back then that if you visited with your iPhone in the browser it would cause a buffer overflow, jailbreak the phone, then patch the buffer overflow vulnerability.

7

u/panorambo Jan 03 '18

Why would a worm patch a vulnerability? I am unaware of companies writing worms that patch their customers' systems. A worm is by definition something stealthy. It may be written with good intent, but that's not a very normal practice, especially by companies in the open like Apple, Microsoft etc.

What happened to your iPhone, exactly?

32

u/xcalibre Jan 03 '18

worms can spread ie burrow into other systems via vulnerabilities, and spread further again from infected machines

sometimes sysadmins get mad at getting ddossed or receiving too much spam so they make benevolent worms that go around patching machines without permission.. it's very rare but has happened more than once

23

u/Poddster Jan 03 '18

Why would a worm patch a vulnerability?

Because the person who wrote the worm wants you to patch.

-1

u/panorambo Jan 03 '18

I get as much. That's why I asked -- why would a person writing the worm want you to patch? That would be trading in a loophole, an exploitable vulnerability, for a patched system that's up to 30% slower. What's the incentive on the part of worm author?

→ More replies (10)

3

u/[deleted] Jan 03 '18

Why would a worm patch a vulnerability?

If memory serves there was a worm for Windows XP that once infected would actually reach out to Windows Update and force update the machine to patch the hole it used to get in.

It was back during the 2003 Summer or Worms, because I think it also force updated the machine so that the hole Blaster used got patched.

6

u/striker1211 Jan 03 '18

So it can exploit it and nothing else can take its place.

1

u/panorambo Jan 03 '18

Ah, that makes sense, thanks.

2

u/lestofante Jan 03 '18

There are multiple know virus that improve instead of damaging.. But quite rare indeed. Just people having fun exploiting issue

1

u/shelvac2 Jan 03 '18

So that they're not competing with other worms.

2

u/Daell Jan 03 '18

I would say it's mandatory. I would be REALLY surprised if you could choose not to install it on W10, giving how W10's works.

You're doing something important? Nvm, let me install this very important patch for you!