Security Researchers Detail New "BlindSide" Speculative Execution Attack

[milkylainen]

Took some serious effort though. 200+ seconds.

[Jabberwocky]

Are ARM immune or did they just not test them? Because they do speculative execution too

They were not tested (only Intel and AMD)

Cortex-A53 (2012) and newer A55 (2017) uses in order execution pipelines. The A53 is used in Raspberry Pi 3 (and 3+).

Cortex-A72 and newer versions (all the way to A77) uses a "out-of-order, speculative issue 3-way superscalar execution pipeline". The A72 is used in Raspberry Pi 4.

Hopefully the Raspberry Pi Foundation learns it's from this. ARM at least announces vulnerabilities while Raspberry Pi Foundation just ignores it. This is the ONLY post made by them and not updated after the release of the Raspberry Pi 4... "Why Raspberry Pi isn’t vulnerable to Spectre or Meltdown" -- https://www.raspberrypi.org/blog/why...e-or-meltdown/

[Teggs]

Extra points for the researchers actually testing on AMD for once.

intel swiss-lake...

Haha. But I don't think anyone outside the United States will get that joke.

[Charlie68]

An attack that works on an AMD CPU? Is this fake news or what? 'Cause everyone, esp. on this site, keeps saying AMD is 100% safe against this kind of stuff...

Who said it ? Claiming that AMD CPUs have fewer speculative vulnerabilities than Intel does not mean that they are 100% secure. There is nothing 100% certain in life, let alone in software-hardware.
Next time you hear someone talking about 100% secure software or hardware, just tell them they don't understand shit.

[elatllat]

So The Odroid C4 running RedoxOS would be the most secure, performant option. Amazon/Apple/Microsoft all have custom ARM chips and more money than everyone else, it would be nice if they stepped in and fixed this mess. (Intel and AMD can't be botherd apparently)

[bison]

Nope, you are wrong. OOO does not require speculation. OOO is perfectly safe, at least as far as we currently know .

I wonder how many more years it will be until the realization comes: "We need to give up on speculation."

[Amaranth]

Also, speculation is safe if done just on registers and a few buffers close to the ALU. The problem with current CPUs is that manufacturers are relentlessly and dangerously speculating on every shit they can think of to get out that last 1% performance. Than the CPU looks good on benchmarks when it is released.

One of the variants of Spectre is called Rogue System Register Read so I wouldn't be so sure registers are safe. On top of that the Cortex-A57 at least is vulnerable to Spectre-3a as well which is basically "meltdown but for registers".

[ed31337]

I wonder how many more years before the CPU manufacturers realize that they can offer a user-controlled option to disable speculation (a so-called "chicken bit") and carve out a niche marked there of customers who value additional security.

Don't we already have something like that with chips that employ ARM's big.LITTLE architecture?

[angrypie]

so where are the non speculative CPU's? is it still possible or will this push us back to pre-P4 era (performancewise)?

In-order designs with today's performance won't be possible unless we break the memory wall.

On the other hand, with the performance impact of mitigating those flaws we'd be better off with an overclocked 486 + modern extensions.

[Raka555]

So The Odroid C4 running RedoxOS would be the most secure, performant option. Amazon/Apple/Microsoft all have custom ARM chips and more money than everyone else, it would be nice if they stepped in and fixed this mess. (Intel and AMD can't be botherd apparently)

That would be a very secure combo in theory.