Further Analyzing The Intel CPU "x86 PTI Issue" On More Systems

[PuckPoltergeist]

Meltdown allows privilege escalations,

No, it's not. You can read memory, that you aren't allowed to. But you don't get the rights to do so.

[caligula]

if bug dates back to Pentium days, I wonder how it's possible that it's discovered after 25 years. how many people knowed about it before? if it's so old and AMD didn't duplicated it, did they know about it?

NSA asked Intel not to fix it.

[Tomin]

Patch for it being disabled for AMD has already been merged so No, Not default as its in rc release anyway. Even the arch guys have made sure the patch is in to.

Well, it wasn't mainline at the time and technically still isn't, because rc7 is not out yet. That's why I said "for now". And of course distribution packagers can pick whatever patches they like.

I wonder why they don't have a general way of excluding processors. Having an if clause for one vendor seems stupid if there are many processors that are not affected by this. Maybe they are working on that or something.

[carewolf]

No, it's not. You can read memory, that you aren't allowed to. But you don't get the rights to do so.

Reading memory you are not allowed to could easily give you information to get privilege escalation.

[nanonyme]

Reading memory you are not allowed to could easily give you information to get privilege escalation.

Wonder if you could first do failed login attempt to force kernel to read shadow file, then use Meltdown to access the shadow file from cache and start passively bruteforce shadow file open

[willmore]

Would PKU mitigate this? Or AMD's memory encryption tech?

[nanonyme]

Would PKU mitigate this? Or AMD's memory encryption tech?

AMD CPU's are not subject to Meltdown anyway

[fuzz]

No, there are two separate issues. The original issue that started investigation into such patches a year ago, and the issue that is causing a scramble now. AFAIK All modern CPU including AMDs are affected by the original issue, but it is more of theoretical thing that reveals a bit of data that can circumvent a secondary security measure. No OS would accept a heavy performance penalty for what is only a second-line security-by-obfuscation feature, so there is a new issue that only affects Intel CPUs. There is where the FUD comes in. Intel are trying to talk about the general vulnerability while the one everyone are and should only be concerned with is the Intel-specific one.

Right, the one that affects people currently (like big datacenters) and will cost quite a bit of money dealing with capacity is the one Intel is trying to cover up.

[willmore]

AMD CPU's are not subject to Meltdown anyway

What about SPECTRE?

[carewolf]

What about SPECTRE?

Spectre isn't fixed by the PTI patches and thus not really relevant to the discussion. Also, it is a much less severe "bug".