Google Makes Disclosure About The CPU Vulnerability Affecting Intel / AMD / ARM

[newwen]

It seems that only the Spectre vulnerability affects AMD and ARM. I don't know if the the kernel page table isolation patch also fixes this or it is solved in some other way.

[eydee]

It doesn't list anything specific. Could be an Athlon XP or Phenom, Opteron etc. and then no one is lying. We need actual details, and code that can be used for testing.

[newwen]

According to this, https://spectreattack.com/spectre.pdf, the KAISER patch doesn't protect against Spectre vulnerability, which is the one that affects ARM and AMD. That paper proposes some mitigation strategies, but the only way to protect against this is to halt speculative execution.

[nuetzel]

Looks like there are two Vulnerabilities, but only Meltdown(Intel only) allows access to system memory. Spector just looks like it allows applications to access other application memory, and should be fixed by individual apps.

Edit: Actually it looks like Zen is not affected by any of them.

https://googleprojectzero.blogspot.com/

Zen AFAIK is immune to all 3 exploits.

https://twitter.com/ryanshrout/status/948683677244018689

Good one!

[nanonyme]

Yeah, this needs to be quoted:




Question is: does our PTI protect only from Meltdown, but not Spectre or both? Spectre sounds like separate issue really, which goes potentionaly & countinuosly further beyond in future

As the researchers said Meltdown fixes in kernel are workrounds and should be disabled once hardware is fixed, I hope they're not now enabling it for unaffected hardware

[dungeon]

OK, i have readed more here https://spectreattack.com/spectre.pdf

Unlike Meltdown, the Spectre attack works on non-Intel processors, including AMD and ARM processors. Furthermore the KAISER patch, which has been widely applied as a mitigation to Meltdown attack, does not protect against Spectre.

So with this, it is obvious that AMD CPUs does not need PTI at all Let Intel-only run that

[mphuZ]

Google says their Project Zero team last year discovered serious flaws in speculative execution

LOL! And has "decided to correct the mistake" just now? Looks like someone decided to stand up for the Intel

[metalliax]

Michael your posts are starting to seem suspicious. Google did not say AMD is affected by the same problem that the KPTI patch addresses. Your latest headlines over the past 8 hours are starting to read like a large entity is providing extra donations.

I'm not accusing... this just doesn't pass the sniff test.

[GunpowaderGuy]

I wonder how this will affect risc V

[Spooktra]

Michael your posts are starting to seem suspicious. Google did not say AMD is affected by the same problem that the KPTI patch addresses. Your latest headlines over the past 8 hours are starting to read like a large entity is providing extra donations.

I'm not accusing... this just doesn't pass the sniff test.

I love how the AMD apologists are starting to come out of the woodwork all over the 'net.

I'm not accusing...just saying it seems like some 3 letter entity that has trouble posting a profit for more than a quarter at a time may have some extra staff out there spreading FUD.