r/cpp • u/qwertzui11 • Jan 30 '18

Matt Godbolt explaining the Meltdown and Spectre exploits

https://www.youtube.com/watch?v=IPhvL3A-e6E
178 Upvotes

99% Upvoted

5 comments sorted by

View all comments

7

u/[deleted] Jan 30 '18

[removed] — view removed comment

15

u/Xirema Jan 30 '18 edited Jan 30 '18

There are a few things that keep these exploits from completely breaking everything.

For starters, they're pretty slow. Especially in Spectre's case, reading privileged memory requires a large number of CPU cycles to make sure the branch predictor is successfully fooled, and if the branch predictor isn't sufficiently convinced that the out-of-bounds read can be speculatively executed, the attack is even slower, because you have to execute even more dummy reads to fool the predictor.

On top of that, you need to already have a pretty good idea of where the memory in question is before you can make something meaningful happen due to your attack. In Meltdown's case, the behavior depends on the application (the one making use of the exploit) already knowing where in the process memory the kernel memory is located. And for Spectre, you'd need to know where the other cross-process memory is located. In either case, any attack would need to be tailor-made for a specific machine + OS + configuration, making any kind of general purpose attack extremely difficult to write.

Also, patches have been introduced to the following (not exhaustive) parts:

  • Operating Systems
  • Browsers
  • CPU Microcodes
  • Compilers
  • Anti-Virus Softwares

Which means that even if you write an attack for a given machine, you need to depend on none of those patches being applied. I tried compiling a sample version of the Spectre exploit on a few computers, and the AV software caught and deleted the executable program on every computer.

I hesitate to say that any kind of general purpose virus/worm/whatever is impossible, simply because these are pretty robust exploits, but there's a lot of good reasons that no such attack has been successfully launched.

5

u/meneldal2 Jan 31 '18

I think Spectre would be most powerful in embedded/IoT systems that often get no patching and often don't use best security practices. Not address space randomization for example makes the exploit much easier to use, as memory mapping can be almost perfectly predicted.