[HN Gopher] CacheWarp: A new software fault attack on AMD SEV-ES...
       ___________________________________________________________________
        
       CacheWarp: A new software fault attack on AMD SEV-ES and SEV-SNP
        
       Author : g0xA52A2A
       Score  : 46 points
       Date   : 2023-11-14 19:56 UTC (3 hours ago)
        
 (HTM) web link (cachewarpattack.com)
 (TXT) w3m dump (cachewarpattack.com)
        
       | I_Am_Nous wrote:
       | These things seem to go in pairs, as there is currently a new
       | Intel CVE on the frontpage too. Someone in the Intel thread
       | mentioned that the underlying issue may be x86 having more and
       | more stuff piled on top of it. That's been great for
       | compatibility, but I'm wondering if it might be worth Intel/AMD
       | making an x86 lite that strips everything but the necessary
       | instructions.
        
         | tim-- wrote:
         | Isn't this partly what Intel wants to do with X86-S?
         | https://www.intel.com/content/www/us/en/developer/articles/t...
         | 
         | Stripping away old/unused instructions from the legacy x86
         | arch.
         | 
         | I would assume though that much of the new security
         | vulnerabilities are not coming from these legacy instructions
         | though. Surely they would be battle tested by now?
        
           | I_Am_Nous wrote:
           | The newest Intel CVE seems tied to some legacy handling of
           | duplicate prefixes, where it usually ignores duplicate
           | prefixes since they were used to pad memory registers
           | sometimes. A newer feature added onto x86 is the underlying
           | problem (FSRM), but it's mishandling those "battle tested"
           | instructions/improperly reading them.
           | 
           | So really, it's a combination of things that led to this CVE,
           | and the longer we stay on an old platform the more strange
           | combinations we might find!
        
         | Mogzol wrote:
         | This exploit isn't at all related to the Intel CVE, just a
         | coincidence they came out around the same time. And an
         | instruction set that strips everything but the necessary
         | instructions sounds a lot like ARM or RISC-V. No need to re-
         | invent the wheel.
        
           | I_Am_Nous wrote:
           | I'm just thinking about Windows. They are trying to do ARM
           | again, but x86/64 is where they have stayed for compatibility
           | reasons. At a certain point old software won't run on new
           | Windows anyway, so it won't need hardware compatibility with
           | older instructions to facilitate that.
           | 
           | Eventually something will have to change, and is it less work
           | for Intel to shift to ARM than to strip x86?
        
           | krasin wrote:
           | > an instruction set that strips everything but the necessary
           | instructions sounds a lot like ARM
           | 
           | Have you, by any chance, looked into the contemporary ARM
           | instruction set? Just the list of base instructions for
           | A-profile with 1-2 instructions per line takes 14 pages. And
           | then there are SIMD&FP Instructions, SVE Instructions, SME
           | Instructions. Oh, and also M-profile, and Thumb / Thumb-2
           | instructions encodings, and more.
           | 
           | A small glimpse could be made here: https://developer.arm.com
           | /documentation/ddi0602/2023-09/?lan...
        
         | tedunangst wrote:
         | It's patch Tuesday.
        
           | I_Am_Nous wrote:
           | This _does_ make sense, since they can schedule CVE
           | announcements.
        
       | netcoyote wrote:
       | > Specifically, a malicious hypervisor can selectively drop any
       | writes of an AMD SEV-ES and SEV-SNP guest that occurred at an
       | attacker-chosen point
       | 
       | This strikes me as the thing that Raymond Chen calls "being on
       | the other side of this airtight hatchway" [0]. That is, if you've
       | already got control of the Hypervisor then ... you can do
       | anything you want to the guest operating systems. Right?
       | 
       | 0:
       | https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
        
         | depereo wrote:
         | SEV is supposed to protect against exactly that scenario, so
         | it's fairly serious that this protection is unwound here.
        
         | kiririn wrote:
         | Protection against a rogue hypervisor is the main benefit of
         | SEV. The whole point is to raise VM security to equivalent of a
         | bare metal machine with encrypted memory and no exposed DMA
         | channels. Protection from other guests is a nice side effect
         | but should be a given
         | 
         | Sadly this means AWS are still the only ones offering this kind
         | of confidential computing without known flaws, and probably
         | only because they don't have researchers attempting attacks
         | like this on their graviton CPUs
        
       | crest wrote:
       | Oh no the snake oil is leaking.
        
       ___________________________________________________________________
       (page generated 2023-11-14 23:00 UTC)