Difference between revisions of "Speculative Execution Vulnerabilities of 2018"

From RCS Wiki
Jump to navigation Jump to search
m
(add google naming system to table)
Line 1: Line 1:
In January of 2018, news of three speculative execution vulnerabilities was made public.
+
In January of 2018, news of three speculative execution vulnerabilities was made public. Information about these vulnerabilities had been disclosed in private to certain companies and projects in June of 2016.  
  
 
{| class="wikitable sortable"
 
{| class="wikitable sortable"
 
! CVE
 
! CVE
 
! Group
 
! Group
 +
! Google Project Zero name<ref>[https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html Reading privileged memory with a side-channel]. Project Zero blog</ref>
 
|-
 
|-
 
| CVE-2017-5715
 
| CVE-2017-5715
 
| Spectre
 
| Spectre
 +
| Variant 2: branch target injection
 
|-
 
|-
 
| CVE-2017-5753
 
| CVE-2017-5753
 
| Spectre
 
| Spectre
 +
| Variant 1: bounds check bypass
 
|-
 
|-
 
| CVE-2017-5754
 
| CVE-2017-5754
 
| Meltdown
 
| Meltdown
 +
| Variant 3: rogue data cache load
 
|}
 
|}
  

Revision as of 12:11, 24 February 2018

In January of 2018, news of three speculative execution vulnerabilities was made public. Information about these vulnerabilities had been disclosed in private to certain companies and projects in June of 2016.

CVE Group Google Project Zero name[1]
CVE-2017-5715 Spectre Variant 2: branch target injection
CVE-2017-5753 Spectre Variant 1: bounds check bypass
CVE-2017-5754 Meltdown Variant 3: rogue data cache load

At this time we know that POWER9, POWER8, POWER8E, POWER7+, POWER6, and certain PowerPC architectures are affected by at least some of these vulnerabilities. [2][3][4][5]

CVE-2017-5754 (Meltdown)

Common Mitigations

POWER7, POWER8, and POWER9 are patched from CVE-2017-5754 by purging the L1 cache when context switching to a less privileged process, as the vulnerability on these architectures affects L1 but not L2 cache.[6] Firmware updates are also required to enable workarounds at the hardware level.[7] [8].

POWER9

Hardware fixes are also in place for POWER9 Nimbus DD2.2 / Cumulus DD1.1 and above [9]. In conjunction with the above kernel patch, Meltdown is fully mitigated on the production POWER9 devices.

CVE-2017-5753 (Spectre variant 1)

POWER9

Hardware fixes are in place for POWER9 Nimbus DD2.2 / Cumulus DD1.1 and above [9]. With these hardware changes, cross-process attacks via Spectre variant 1 are believed to be fully mitigated on the production POWER9 devices.

CVE-2017-5715 (Spectre variant 2)

POWER9

Hardware fixes are in place for POWER9 Nimbus DD2.2 / Cumulus DD1.1 and above [9]. With these hardware changes, Spectre variant 2 is believed to be mitigated on the production POWER9 devices.

Official statement from Raptor Computing Systems regarding Talos™ II

POWER9 will not ship with vulnerability to Meltdown or any loss in performance compared with the current prototype chips (DD2.1). Further, Spectre is fully mitigated with the exception of the same-process issue that is affecting the entire CPU industry. As far as we are aware there will be no further mitigation from any major CPU vendor now or in the future, as the remaining Spectre issue has been deemed an application level programming issue versus a CPU design issue. Patches for GCC to help fix the affected applications are already rolling out.

External Links

References