About speculative execution vulnerabilities in ARM-based and Intel CPUs

https://support.apple.com/en-us/HT208394

by gok • 9 years ago

228 104 9 years ago

support.apple.com

MBCook• 9 years ago

They say the watches aren’t effected.

Is it possible that they don’t do speculative execution?

trynumber9• 9 years ago

That's probably it. The original S1 was based on the A7 which was in-order. But I can't find information on the S2 onward.

kridsdale3• 9 years ago

I don’t have any citations but I believe the S1 is actually based on the A4 of all things. It was 32 bit.

blattimwind• 9 years ago

Highly unlikely.

Apple Watch is not affected by Meltdown.

i.e. by the lemma of overly specific dementi it follows that Apple Watch is affected by Spectre.

jmull2• 9 years ago

I think it's only Meltdown that the watch isn't affected by.

It sounds like it is potentially affected by Spectre, especially since they say they will be continuing to develop mitigations for WatchOS.

The surprising thing to me is that they patched iOS to mitigate Meltdown. Before now, I thought it was only Intel chips that were affected by Meltdown, but I guess Apple's own A-series processors are affected too.

pkaye• 9 years ago

Yes some ARM Cortex A-series are affected by a variant of Meltdown. https://developer.arm.com/support/security-update

tischler5• 9 years ago

Apple has already released mitigations in iOS 11.2, macOS 10.13.2, and tvOS 11.2 to help defend against Meltdown.

What about macOS 10.12 and earlier versions?

dylz• 9 years ago

My work machine is 10.12 and patched today.

Sierra and El Capitan is covered too.

https://support.apple.com/en-us/HT208331 - see Kernel entries.

tischler5• 9 years ago

10.12 is Sierra. I cannot see any security update in the updates tab of the App Store app, nor in the list of updates that were installed in the last 30 days.

lowbloodsugar2• 9 years ago

So, older versions not fixed? Who is most likely to be running older version? Corporations? Ah, they probably don't care.

coldcode• 9 years ago

Sierra and El Capitan are covered too.

lowbloodsugar2• 9 years ago

Do you have a source for that because:

a) The article above doesn't mention it (specifically says 10.13), and

b) There are no updates available for my mac.

cls592• 9 years ago

I'm running an older version because I prefer to let other folks grind the rough edges off of the APFS filesystem before taking the plunge myself.

kridsdale3• 9 years ago

I felt the same as you, and the .0 people had a rough time. i went for it in .2 and it’s been fine.

nnx• 9 years ago

Interesting that this seems to say that A-series processors are vulnerable to Meltdown (or a variant of it).

Could this “check later” speculative approach similar to Intel’s explain Apple’s great performance advantage over other ARM CPUs?

mbroncano• 9 years ago

It's mostly assumed the refered performance advantage is directly related to the better and bigger caches in the microprocessor. I'd be surprised that their OOO technique is fundamentally different than other vendors.

duskwuff• 9 years ago

Could this “check later” speculative approach similar to Intel’s explain Apple’s great performance advantage over other ARM CPUs?

No. Speculative execution is not unique to Apple's SoC designs; it's present in other ARM cores as well.

https://developer.arm.com/support/security-update

chx• 9 years ago

but there are no known exploits impacting customers at this time

known by whom? Apple? Then say "we do not know of any exploits". Is the answer different for the NSA? Who the f knows?

blinkingled2• 9 years ago

So nothing required on hardware side? I was under the impression that OEMs need to send out BIOS/UEFI Firmware updates or at least CPU Microcode updates but doesn't look like Apple is planning to do so.

nly• 9 years ago

Microcode updates will come down the pipe to users as OS updates as Intel uses these channels.

blinkingled2• 9 years ago

Yeah I think if a UEFI update comes down it might bring the mitigated uCode with it. Just got to boot into USB macOS installation - don't think Boot Camp users get those updates.

kridsdale3• 9 years ago

MacOS update packages include any relevant firmware updates at the same time.

earenndil• 9 years ago

At least in the linux kernel, it was patched by essentially throwing off the branch predictor following every syscall, which didn't require any hardware, bios, or microcode patches.

AaronFriel• 9 years ago

Our testing with public benchmarks has shown that the changes in the December 2017 updates resulted in no measurable reduction in the performance of macOS and iOS as measured by the GeekBench 4 benchmark, or in common Web browsing benchmarks such as Speedometer, JetStream, and ARES-6.

This is incredibly deceptive, because web workloads are precisely the sort not expected to be impacted by Meltdown most. As I've written elsewhere, it's syscall heavy workloads targeting fast devices, like database software on PCIe SSDs, that will suffer the greatest slowdowns.

empthought• 9 years ago

This spells certain doom for Apple’s vaunted supremacy in supplying high-performance hardware for database usage.

jonny_eh3• 9 years ago

Why? Is their competition not affected?

jmull2• 9 years ago

it's syscall heavy workloads targeting fast devices, like database software on PCIe SSDs, that will suffer the greatest slowdowns.

That's not exactly a common scenario for macOS, much less iOS devices.

It's fair to call for benchmarks that are more representative of common workloads, not less representative.

lambda• 9 years ago

Avid Media Composer, one of the most popular non-linear video editors in the industry, does a stat of every piece of media referenced in every project you have open when you change focus from another application back to Avid Media Composer.

Since I work on network attached storage for video editing, I'm acutely aware of how much slowing down a few simple syscalls by just a little bit can be for certain very commonly used applications on macOS.

matthew-wegner• 9 years ago

This patch was released on December 6th, and there haven't been reports of decreased performance from scientific/video editing/etc folks. The worst-case workloads are probably not happening on macOS anyway.

javitury• 9 years ago

Apple, like intel, is a hardware vendor. They are better off ignoring the performance impairment than recognizing it. Both because of potential litigation costs* and because the performance impact could shift customers away.

*Edit: Also potential reimbursements/compensations and manageing them.

Edit2: What if customers decided to return en mase their new iphone X or macbook they got for christmas?

matthewmacleod• 9 years ago

Or, far more likely, and more importantly _actually the case here_, the performance impact for most common macOS workloads is likely to be negligible.

Not everything is a conspiracy theory.

Analemma_• 9 years ago

Since exploiting many of these issues requires a malicious app to be loaded on your Mac or iOS device, we recommend downloading software only from trusted sources such as the App Store

Haven’t there been JavaScript POCs for Meltdown? That’s already patched and AFAIK there’s nothing for Spectre yet, but this is still a little disingenuous.

acdha• 9 years ago

Aren’t the browser patches already shipping? The JS risk should be significantly lower with days.

drdrey• 9 years ago

I must say I am pleasantly surprised by the straightforward, no BS language

Waterluvian• 9 years ago

It was better. I'm confused how the title says Intel and ARM but the first paragraph says all processors.

alsetmusic• 9 years ago

It was better. I'm confused how the title says Intel and ARM but the first paragraph says all processors.

These are the processors found in Apple products.

Yesterday, there were comments [edit: on HN] about the Intel PR announcement that were critical of the fact that Intel name-dropped AMD in what was thought to be an attempt to deflect the issue from the Intel brand.

Aloha• 9 years ago

I am as well - this is something I can link to people who do not understand microarchitectures, so they can understand what these bugs are.

tischler5• 9 years ago

Except they forgot to tell us about older versions of macOS which probably 75%[1] of Apple users still use.

[1] http://gs.statcounter.com/macos-version-market-share/desktop...

notadoc3• 9 years ago

Hopefully Sierra and El Capitan will get patched soon.

thelibrarian3• 9 years ago

Security Updates were released for 10.6 and 10.5 (2017-002 and 2017-005 respectively).

tischler5• 9 years ago

The patch for Meltdown (CVE-2017-5754) for High Sierra, Sierra and El Capitan was contained in these security updates from December 6: https://support.apple.com/en-us/HT208331

wyldfire• 9 years ago

In the coming days we plan to release mitigations in Safari to help defend against Spectre.

If Apple was able to patch macOS in the ~6 month window since the issue was discovered why were they unable to patch Safari?

Same question for Chrome and Firefox. Surely Google knew about it and hopefully they contacted Mozilla. It seems like the scope of the fixes for Chrome and Firefox are the same.

Does it really take six months to do dev & QA for a fix like this? Wasn't the plan to disclose this to the public in January anyways?

walterbell4• 9 years ago

What about iOS10 users who need to run 32-bit apps?

scarface743• 9 years ago

How long has Apple warned users that 32 bit software wasn't going to be supported?

For context, the only phones that are not being supported by the latest patch are iPhones introduced before 2013.

walterbell4• 9 years ago

If the app vendor has gone out of business and there is substantial data in the 32-bit app, there may be no upgrade alternative.

torgard• 9 years ago

Intel said its chips, which power Macs and devices from other manufacturers, contain the flaw as well as processors based on ARM Holdings architecture, which is used in iOS devices and Android smartphones.

Has it been proven that Meltdown can affect ARM processors, or is this Intel speculation?

Kocrachon• 9 years ago

It can impact them, just not to the same extreme. I believe ARM is only impacted when data is user space to user space.

gmartres2• 9 years ago

According to ARM yes, but only on a few architectures: https://developer.arm.com/support/security-update (Meltdown is CVE-2017-5754 and is responsible for Variant 3 and Variant 3a). See also https://github.com/marcan/speculation-bugs/blob/master/READM... which tries to summarize every known attack/platform/mitigation.

Kikawala• 9 years ago

Meltdown affects Intel chips, Spectre affects Intel, AMD, and ARM chips.

Xorlev• 9 years ago

Spectre likely affects any chip with speculative execution, regardless of vendor, even things like Power8. So that's fun.

gmartres2• 9 years ago

Meltdown also affects some ARM chips according to ARM itself: https://developer.arm.com/support/security-update

smallnamespace• 9 years ago

Cache timing attacks are a pretty general technique, and just depends on the combination of speculative execution + not flushing the cache upon misprediction rollback (which would be very expensive).

It would be a huge surprise if ARM were somehow immune.

cbhl• 9 years ago

Google tested a Proof-of-Concept exploit against an ARM Cortex A57.

https://googleprojectzero.blogspot.com/2018/01/reading-privi...

disclaimer: I work at Google, but not on Project Zero.

imagetic• 9 years ago

What about macOS 10.12? I haven't seen enough stability across applications with High Sierra to make the upgrade for work machines. I guess we'll have to just wait it out to see what they actually release.

om25• 9 years ago

It's gotten the same patches as 10.13. The original security advisory did not mention it, but it's been revised now: https://support.apple.com/en-us/HT208331

  Kernel
  Available for: macOS High Sierra 10.13.1, macOS Sierra  10.12.6, OS X El Capitan 10.11.6
  Impact: An application may be able to read kernel memory
  Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
  CVE-2017-5754: Jann Horn of Google Project Zero, Werner Haas and Thomas Prescher of Cyberus Technology GmbH, and Daniel Gruss, Moritz Lipp, Stefan Mangard and Michael Schwarz from Graz University of Technology

klondike_• 9 years ago

I wonder what's going to happen to old Android devices that are no longer receiving security updates

walterbell4• 9 years ago

If there are no global, industry-wide incentives to fix this particular, once-in-twenty-years issue, they become the world's largest botnet.

Apple and Google should want old devices to be patched, to avoid teaching consumers that their devices cannot be trusted.

workthrowaway272• 9 years ago

There's no remote exploit though, right? So the only way an attacker could turn this into a botnet would be to somehow get Android apps to run attacker controlled code or exploit existing code that fits the pattern described in the attacks (seems not to exist in practice). These aren't super high bars, but they do make the exploit significantly harder.

jacksmith210062• 9 years ago

Google will on their pixel phones. But the other OEMs tend to not be good about updates. A big plus for the Pixel in the Android world.

pjmlp3• 9 years ago

Nothing.

Until Google takes the stand and actually forces OEMs to update, nothing will ever change.

Not for existing devices, nor for Treble certified ones.

Updates are only for rich people able to pay 500€+ for flagship devices every three years.

Mindwipe2• 9 years ago

Treble is counterproductive to this sort of problem anyway. But abstracting the OS to a layer sat above a quasi-HAL as it does, users will get OS updates with features but without updates to the underlying hardware interface blobs. The incentive for OEMs to update drivers for security goes down radically, not up, because the users crying out for OS feature x get it without having to update anything below the abstraction layer.

Ultimately the problem with Android driver security is that Qualcomm has no interest in it, and won't until some form of legislation from a large territory such as the US, EU or China forces their hand on it.

microtonal• 9 years ago

Updates are only for rich people able to pay 500€+ for flagship devices every three years.

And only when you buy it on day one:

Pixel phones get security updates for at least 3 years from when the device first became available on the Google Store, or at least 18 months from when the Google Store last sold the device, whichever is longer. After that, we can't guarantee more updates.

Source:

https://support.google.com/pixelphone/answer/4457705?hl=en

jacksmith210062• 9 years ago

Google will for the Pixel and if the other OEMs drag their feet more will get the Pixel. That is on the OEMs.

kilon• 9 years ago

Damn it’s 2000 all over again. Cybermagedon is the most annoying thing. It always appears when I am in low supply of pop corn.

bitL• 9 years ago

Hmm, so Apple confirms that meltdown happens on ARM as well, interesting. Likely their Axx chips are way faster than competition, allowing the timing window in which to execute the attack, as Google suggested.

jlouis• 9 years ago

The speed isn't the issue. It is all about speculation and prediction

HugoDaniel2• 9 years ago

Does Geekbench test for TLB flushes at syscalls or whatever other kind of "mitigation" they introduced in 10.13.2 ? Where can we see true benchmarks of performance comparison between previous and current version in regards to this bug ? Isn't Apple being really nasty by exploiting the lack of knowledge of the general public ?

I am no expert in any way but would like to know how did they "mitigated" this without a serious performance hit.

brigade• 9 years ago

More like Phoronix doesn’t do any analysis of what they’re benchmarking and the general public quoting them can’t do that for them.

Besides, syscalls have historically been slow on OS X; back when the kernel was 32-bit the kernel and user space had completely separate address spaces (unlike windows and default Linux) and I’ll bet even most power users never realized.

Strom2• 9 years ago

You should try defining this mystical true benchmark that you seek.

Apple decided that heavy userspace execution and web performance are representative of common workloads. You are welcome to argue for a different kind of workload. As it stands now, at best you're implying that it's common for users to execute syscalls in a loop.

HugoDaniel2• 9 years ago

Can you tell with any degree of precision what kind of benchmark the "GeekBench" is and does ? What guarantees do you have that it is testing "real world common workloads" ?

Do you think common users execute guassian blurs in a loop and ray tracers before perfoming rigid body physics in their "common workloads" ? As you said, I know I am welcome to argue for a different kind of workload, specially when I am being taken for a fool.

jluxenberg• 9 years ago

Apple patched Meltdown (not Spectre) for Sierra in "Security Update 2017-002" on Dec. 6th 2017. They are not doing a point release; the latest version of Sierra is 10.12.6

If you want to check that you have installed this update, you can use the following command:

  $ system_profiler | grep 'Security Update 2017-002'

liamzebedee• 9 years ago

Are secrets within the secure enclave vulnerable? e.g. Bitcoin wallet keys

Jyaif• 9 years ago

I wonder if Apple can retro-actively add the retpoline trick to the apps submitted in bitcode. If so, then I expect Apple to make bitcode mandatory.

About speculative execution vulnerabilities in ARM-based and Intel CPUs

Related Stories