OS2 World Community Forum

OS/2, eCS & ArcaOS - Technical => Programming => Topic started by: warpsalad on January 03, 2018, 04:01:41 am

Title: OS/2 kernel requiring speculative execution patch!!!!
Post by: warpsalad on January 03, 2018, 04:01:41 am
So I'm sure many are aware of the news regarding the flaw in Intel's speculative execution in the majority of the CPUs:
https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

The problem doesn't end there, it affects anything i686 and newer (as this was when speculative execution was introduced):
https://en.wikipedia.org/wiki/P6_(microarchitecture)

Which means, anything Pentium II and newer is affected.

Will ArcaNoae be working on patching the OS/2 kernel with KPTI? Otherwise I won't be able to consider OS/2 a viable OS for going on the internet anymore for anything personal.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Dave Yeo on January 03, 2018, 04:27:05 am
We'll have to wait for the embargo on how this works exactly to end, which is supposed to be soon. There are a lot of unknowns, which CPU's exactly, I heard all produced in the last 10 years. Is it just in 64 bit mode? And such.
I can't talk for Arca Noae, but I doubt that they're capable of patching this, it's not like they have the kernels source. The OS4 kernel could be patched.
Anyways, in many ways our platform is insecure to begin with. We're always at least a year behind in browsers, which means security holes and the possibility that one tab is spying on another. Things aren't sandboxed, especially the browser, which is our biggest security hole.
On the other hand, I doubt that many people will be writing code to use against the few OS/2 users, there are much better targets. The NSA may be able to log into the Intel management engine or the AMD equivalent and basically run software at ring -1 with complete access to the computer and sooner or later someone else is going to use the same backdoor.
There's also the question of whether this flaw really affects OS/2 as I believe the kernel memory runs in a separate segment, something that is not supported by 64bit mode and I believe gives some protection.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: warpsalad on January 03, 2018, 04:34:42 am
We'll have to wait for the embargo on how this works exactly to end, which is supposed to be soon. There are a lot of unknowns, which CPU's exactly, I heard all produced in the last 10 years. Is it just in 64 bit mode? And such.
Speculative execution was introduced on i686, so anything Pentium 2 and onward basically, is affected. It is not just 64-bit as 32-bit Linux is affected as well.

I can't talk for Arca Noae, but I doubt that they're capable of patching this, it's not like they have the kernels source. The OS4 kernel could be patched.

Then OS/2 is should only be ran on AMD processors if it's being exposed to the internet (which is a problem for me since my ThinkPads are Intel that support stuff in OS/2 I use). This is a pretty big problem.

Anyways, in many ways our platform is insecure to begin with. We're always at least a year behind in browsers, which means security holes and the possibility that one tab is spying on another. Things aren't sandboxed, especially the browser, which is our biggest security hole.
On the other hand, I doubt that many people will be writing code to use against the few OS/2 users, there are much better targets. The NSA may be able to log into the Intel management engine or the AMD equivalent and basically run software at ring -1 with complete access to the computer and sooner or later someone else is going to use the same backdoor.
There's also the question of whether this flaw really affects OS/2 as I believe the kernel memory runs in a separate segment, something that is not supported by 64bit mode and I believe gives some protection.
If it affects x86 Linux (which it does) it will sadly affect OS/2. It's not necessarily a problem regarding the NSA or spying (esp. since all of the old CPUs I run OS/2 on don't even have the intel management engine) but the fact that exploitable javascript could steal credentials or your credit card number--and things like that. Which again... means OS/2 on intel won't be viable for anything on the internet anymore, unless someone patches the OS/2 kernel.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Roderick Klein on January 03, 2018, 06:21:52 am
So I'm sure many are aware of the news regarding the flaw in Intel's speculative execution in the majority of the CPUs:
https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

The problem doesn't end there, it affects anything i686 and newer (as this was when speculative execution was introduced):
https://en.wikipedia.org/wiki/P6_(microarchitecture)

Which means, anything Pentium II and newer is affected.

Will ArcaNoae be working on patching the OS/2 kernel with KPTI? Otherwise I won't be able to consider OS/2 a viable OS for going on the internet anymore for anything personal.

If you want to know if  Arca Noae wants to patch the kernel then you should also open a ticket on
https://mantis.arcanoae.com. They have stated repeatedly no ticket=no support.

Roderick
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: ivan on January 03, 2018, 10:38:41 am
Roderick, technically this is not a bug in the kernel since everything is fine with AMD processors. 

It is a bug in the Intel processor itself such that the kernels of all operating systems need an addition to workround the Intel processor bug. 

At the moment all Arca Noae needs to do is send out an e-mail saying either, yes we are considering something, or, no we can't do anything about it - mantis shouldn't need anything.  Since it is so bad they might be able to screw some money out of Intel to do any work necessary.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Olafur Gunnlaugsson on January 03, 2018, 11:16:27 am
If I am reading this correctly it only affects the chips in AMD64 mode, not the i86 mode

https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Olafur Gunnlaugsson on January 03, 2018, 11:20:41 am
BTW, I wonder how long the Intel management has known about this ....

https://www.fool.com/investing/2017/12/19/intels-ceo-just-sold-a-lot-of-stock.aspx
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Lars on January 03, 2018, 02:35:22 pm
There's also the question of whether this flaw really affects OS/2 as I believe the kernel memory runs in a separate segment, something that is not supported by 64bit mode and I believe gives some protection.

As far as I understand, the problem is that even though you cannot access kernel memory from user space, the speculative execution of subsequent instructions following that instruction will allow you to deduce what the instruction attempting to access kernel memory would have produced as a result.
I cannot see what bearing the Intel segmentation mechanism would have on this. You could simply bypass the segmentation mechanism by using linear addresses in your exploit code. 32-bit code will not undergo the segmentation mechanisms anyway (apart from internal functions written in 16-bit requiring thunking of code and data addresses).
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Ian Manners on January 04, 2018, 06:13:24 pm
AMD, Arm also affected by data-leak design blunders

http://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/ (http://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/)

There is a nice code snippet link further down that article =>> https://twitter.com/pwnallthethings/status/948693961358667777 (https://twitter.com/pwnallthethings/status/948693961358667777).
The code is for Windows but it gives the general idea what happens and how.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: David Graser on January 04, 2018, 06:39:08 pm
AMD, Arm also affected by data-leak design blunders

http://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/ (http://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/)

Probably not design blunders.  The CIA and NSA have to have their back doors to breach anyone's computer(s).
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Olafur Gunnlaugsson on January 05, 2018, 01:17:22 am
AMD, Arm also affected by data-leak design blunders

Two different exploits nota bene, only one ARM version affected by the same exploit as the Intel one.

The exploit that hits the PowerPC 8 & 9, PPC Z/OS and AMD FX chips is both much more difficult to exploit and can be fixed in software with no performance penalty.

P.S. Microsoft has already issued a fix for the AMD FX in their latest update package, no performance degaration.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Greg Pringle on January 05, 2018, 04:22:12 pm
It would seem without the specifics on the problem and how software can exploit it then all the comments above are pure speculation.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Ian Manners on January 05, 2018, 06:59:49 pm
A good write up, as of what I have currently found is at:-

https://semiaccurate.com/2018/01/04/kaiser-security-holes-will-devastate-intels-marketshare/ (https://semiaccurate.com/2018/01/04/kaiser-security-holes-will-devastate-intels-marketshare/)

I am having a problem in getting my head around how these problems occur and transcribing them to how OS/2 manages it's memory, to soon after Christmas :o)

It would at least require someone to write the software to target an OS/2 box, and some means to get it delivered.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Dave Yeo on January 05, 2018, 07:27:34 pm
Yea, my understanding is that the way OS/2 manages its memory, getting access to kernel memory isn't that big of a deal as we don't have permissions or sandboxes so just need to read a different tabs memory or even the swap file if one exists.
As for the code, it seems to have to be tight assembler, which, as you say, has to target OS/2 and be delivered.
There is a proof of concept using Chromes JavaScript JIT but even that would have to be targeted as there are many code paths in the JIT depending on CPU etc.
The real problem is in data centres and such as this allows escaping from a virtual machine or/and getting roots password.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Olafur Gunnlaugsson on January 06, 2018, 09:52:49 pm
This link has a rather frightening graphic from Epic Games that shows the performance hit for their servers after a patch had been applied

https://www.epicgames.com/fortnite/forums/news/announcements/132642-epic-services-stability-update
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: warpsalad on January 07, 2018, 02:27:17 am
Yea, my understanding is that the way OS/2 manages its memory, getting access to kernel memory isn't that big of a deal as we don't have permissions or sandboxes so just need to read a different tabs memory or even the swap file if one exists.
As for the code, it seems to have to be tight assembler, which, as you say, has to target OS/2 and be delivered.
There is a proof of concept using Chromes JavaScript JIT but even that would have to be targeted as there are many code paths in the JIT depending on CPU etc.
The real problem is in data centres and such as this allows escaping from a virtual machine or/and getting roots password.

I'd need to see citations or a source test to confirm, because as far as I can tell, it is exploitable on x86 on any OS.

This link has a rather frightening graphic from Epic Games that shows the performance hit for their servers after a patch had been applied

https://www.epicgames.com/fortnite/forums/news/announcements/132642-epic-services-stability-update

Performance will be reduced under the following conditions:
#1 you're using Windows instead of Linux (NT kernel is worse at handling this than the Linux kernel)
#2 your CPUs lack PCID

So it's possible epicmegagames is running NT on pre-westmere CPUs.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Olafur Gunnlaugsson on January 07, 2018, 02:31:54 am
#1 you're using Windows instead of Linux (NT kernel is worse at handling this than the Linux kernel)

Where do you get that info from?
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Dave Yeo on January 07, 2018, 03:16:45 am

I'd need to see citations or a source test to confirm, because as far as I can tell, it is exploitable on x86 on any OS.

Well you can some ideas about proofs of concept code here, https://googleprojectzero.blogspot.ca/2018/01/reading-privileged-memory-with-side.html (https://googleprojectzero.blogspot.ca/2018/01/reading-privileged-memory-with-side.html)

But think about it. What are you trying to protect? You're browsing history? Any process can read files on the disk and history is not encrypted. Your logins? They are encrypted on the disk and in the kernels disk cache memory, other then that they aren't in kernel memory. they may be in the browsers memory, in which case any JavaScript flaw can be used to read them as they're all in the same process. Another program could use Spectre to read a different processes memory.
So a malignant program could in theory read the browsers memory, it is going to have to be an OS/2 program that you run, possibly through trickery. Who is going to go to the trouble to write a malignant program and target you? Quite likely due to timing problems, the code will have to target your exact CPU, which I believe you've mentioned is an old one.
If you're really worried about security, there are easier flaws in our discontinued browser to exploit, often using cross platform code such as JavaScript. Much easier but even then you often get code trying to run C:\Windows\cmd.exe and failing on OS/2.
If you're really worried about security, you should run one of the BSD's and even then there is a risk of a zero day exploit.
The real worry is someone targeting your bank, a much richer target.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: warpsalad on January 07, 2018, 10:47:54 am
#1 you're using Windows instead of Linux (NT kernel is worse at handling this than the Linux kernel)

Where do you get that info from?

I'm honestly surprised at how pro-Windows people are in this day and age when Windows was traditionally derided for being an unstable bucket of frogs (which it still is).

One of the main reasons is that the KTPI fix implemented on Linux does not require PCID, which means performance won't hit pre-westmere CPUs that much. But not only that the way Windows has to work around the problem is a lot more messy due to the way Windows has everything in paged and non-paged pools--whereas this is not the case in Linux or any Unix for that matter because they're not dementedly designed like NT. Just google it, there's sources out there.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Paul Smedley on January 26, 2018, 08:27:37 am
FWIW - GCC 7.3.0 has some fixes to combat the spectre bug. I built the OS/2  binaries - they're currently at http://smedley.id.au/tmp/gcc-7.3.0-os2-20180126.zip but will likely move to dropbox/be added to my site once they're tested more.
Title: Re: OS/2 kernel requiring speculative execution patch!!!!
Post by: Olafur Gunnlaugsson on January 26, 2018, 10:36:43 am
#1 you're using Windows instead of Linux (NT kernel is worse at handling this than the Linux kernel)

Where do you get that info from?

I'm honestly surprised at how pro-Windows people are in this day and age when Windows was traditionally derided for being an unstable bucket of frogs (which it still is).

Its not 1995 anymore

Quote
One of the main reasons is that the KTPI fix implemented on Linux does not require PCID, which means performance won't hit pre-westmere CPUs that much. But not only that the way Windows has to work around the problem is a lot more messy due to the way Windows has everything in paged and non-paged pools--whereas this is not the case in Linux or any Unix for that matter because they're not dementedly designed like NT. Just google it, there's sources out there.

This is nonsense, and and grouping Linux and other Unix system kernels together as a block as you do here, makes no sense either as they are very different designs