Author Topic: OS/2 kernel requiring speculative execution patch!!!!  (Read 2475 times)

Devon

  • Newbie
  • *
  • Thank You
  • -Given: 2
  • -Receive: 5
  • Posts: 34
    • View Profile
OS/2 kernel requiring speculative execution patch!!!!
« on: January 03, 2018, 04:01:41 am »
So I'm sure many are aware of the news regarding the flaw in Intel's speculative execution in the majority of the CPUs:
https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

The problem doesn't end there, it affects anything i686 and newer (as this was when speculative execution was introduced):
https://en.wikipedia.org/wiki/P6_(microarchitecture)

Which means, anything Pentium II and newer is affected.

Will ArcaNoae be working on patching the OS/2 kernel with KPTI? Otherwise I won't be able to consider OS/2 a viable OS for going on the internet anymore for anything personal.

Dave Yeo

  • Hero Member
  • *****
  • Thank You
  • -Given: 8
  • -Receive: 100
  • Posts: 1384
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #1 on: January 03, 2018, 04:27:05 am »
We'll have to wait for the embargo on how this works exactly to end, which is supposed to be soon. There are a lot of unknowns, which CPU's exactly, I heard all produced in the last 10 years. Is it just in 64 bit mode? And such.
I can't talk for Arca Noae, but I doubt that they're capable of patching this, it's not like they have the kernels source. The OS4 kernel could be patched.
Anyways, in many ways our platform is insecure to begin with. We're always at least a year behind in browsers, which means security holes and the possibility that one tab is spying on another. Things aren't sandboxed, especially the browser, which is our biggest security hole.
On the other hand, I doubt that many people will be writing code to use against the few OS/2 users, there are much better targets. The NSA may be able to log into the Intel management engine or the AMD equivalent and basically run software at ring -1 with complete access to the computer and sooner or later someone else is going to use the same backdoor.
There's also the question of whether this flaw really affects OS/2 as I believe the kernel memory runs in a separate segment, something that is not supported by 64bit mode and I believe gives some protection.

Devon

  • Newbie
  • *
  • Thank You
  • -Given: 2
  • -Receive: 5
  • Posts: 34
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #2 on: January 03, 2018, 04:34:42 am »
We'll have to wait for the embargo on how this works exactly to end, which is supposed to be soon. There are a lot of unknowns, which CPU's exactly, I heard all produced in the last 10 years. Is it just in 64 bit mode? And such.
Speculative execution was introduced on i686, so anything Pentium 2 and onward basically, is affected. It is not just 64-bit as 32-bit Linux is affected as well.

I can't talk for Arca Noae, but I doubt that they're capable of patching this, it's not like they have the kernels source. The OS4 kernel could be patched.

Then OS/2 is should only be ran on AMD processors if it's being exposed to the internet (which is a problem for me since my ThinkPads are Intel that support stuff in OS/2 I use). This is a pretty big problem.

Anyways, in many ways our platform is insecure to begin with. We're always at least a year behind in browsers, which means security holes and the possibility that one tab is spying on another. Things aren't sandboxed, especially the browser, which is our biggest security hole.
On the other hand, I doubt that many people will be writing code to use against the few OS/2 users, there are much better targets. The NSA may be able to log into the Intel management engine or the AMD equivalent and basically run software at ring -1 with complete access to the computer and sooner or later someone else is going to use the same backdoor.
There's also the question of whether this flaw really affects OS/2 as I believe the kernel memory runs in a separate segment, something that is not supported by 64bit mode and I believe gives some protection.
If it affects x86 Linux (which it does) it will sadly affect OS/2. It's not necessarily a problem regarding the NSA or spying (esp. since all of the old CPUs I run OS/2 on don't even have the intel management engine) but the fact that exploitable javascript could steal credentials or your credit card number--and things like that. Which again... means OS/2 on intel won't be viable for anything on the internet anymore, unless someone patches the OS/2 kernel.

Roderick Klein

  • Full Member
  • ***
  • Thank You
  • -Given: 0
  • -Receive: 8
  • Posts: 231
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #3 on: January 03, 2018, 06:21:52 am »
So I'm sure many are aware of the news regarding the flaw in Intel's speculative execution in the majority of the CPUs:
https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

The problem doesn't end there, it affects anything i686 and newer (as this was when speculative execution was introduced):
https://en.wikipedia.org/wiki/P6_(microarchitecture)

Which means, anything Pentium II and newer is affected.

Will ArcaNoae be working on patching the OS/2 kernel with KPTI? Otherwise I won't be able to consider OS/2 a viable OS for going on the internet anymore for anything personal.

If you want to know if  Arca Noae wants to patch the kernel then you should also open a ticket on
https://mantis.arcanoae.com. They have stated repeatedly no ticket=no support.

Roderick

ivan

  • Hero Member
  • *****
  • Thank You
  • -Given: 1
  • -Receive: 26
  • Posts: 728
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #4 on: January 03, 2018, 10:38:41 am »
Roderick, technically this is not a bug in the kernel since everything is fine with AMD processors. 

It is a bug in the Intel processor itself such that the kernels of all operating systems need an addition to workround the Intel processor bug. 

At the moment all Arca Noae needs to do is send out an e-mail saying either, yes we are considering something, or, no we can't do anything about it - mantis shouldn't need anything.  Since it is so bad they might be able to screw some money out of Intel to do any work necessary.

Olafur Gunnlaugsson

  • Full Member
  • ***
  • Thank You
  • -Given: 27
  • -Receive: 8
  • Posts: 108
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #5 on: January 03, 2018, 11:16:27 am »
If I am reading this correctly it only affects the chips in AMD64 mode, not the i86 mode

https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

Olafur Gunnlaugsson

  • Full Member
  • ***
  • Thank You
  • -Given: 27
  • -Receive: 8
  • Posts: 108
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #6 on: January 03, 2018, 11:20:41 am »
BTW, I wonder how long the Intel management has known about this ....

https://www.fool.com/investing/2017/12/19/intels-ceo-just-sold-a-lot-of-stock.aspx

Lars

  • Full Member
  • ***
  • Thank You
  • -Given: 0
  • -Receive: 28
  • Posts: 216
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #7 on: January 03, 2018, 02:35:22 pm »
There's also the question of whether this flaw really affects OS/2 as I believe the kernel memory runs in a separate segment, something that is not supported by 64bit mode and I believe gives some protection.

As far as I understand, the problem is that even though you cannot access kernel memory from user space, the speculative execution of subsequent instructions following that instruction will allow you to deduce what the instruction attempting to access kernel memory would have produced as a result.
I cannot see what bearing the Intel segmentation mechanism would have on this. You could simply bypass the segmentation mechanism by using linear addresses in your exploit code. 32-bit code will not undergo the segmentation mechanisms anyway (apart from internal functions written in 16-bit requiring thunking of code and data addresses).

Ian Manners

  • Global Moderator
  • Sr. Member
  • *****
  • Thank You
  • -Given: 34
  • -Receive: 24
  • Posts: 279
  • I am the computer, it is me.
    • View Profile
    • ComKal Networks Australia
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #8 on: January 04, 2018, 06:13:24 pm »
AMD, Arm also affected by data-leak design blunders

http://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/

There is a nice code snippet link further down that article =>> https://twitter.com/pwnallthethings/status/948693961358667777.
The code is for Windows but it gives the general idea what happens and how.
« Last Edit: January 04, 2018, 06:48:02 pm by Ian Manners »
Cheers
Ian B Manners

David Graser

  • Full Member
  • ***
  • Thank You
  • -Given: 0
  • -Receive: 6
  • Posts: 156
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #9 on: January 04, 2018, 06:39:08 pm »
AMD, Arm also affected by data-leak design blunders

http://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/

Probably not design blunders.  The CIA and NSA have to have their back doors to breach anyone's computer(s).

Olafur Gunnlaugsson

  • Full Member
  • ***
  • Thank You
  • -Given: 27
  • -Receive: 8
  • Posts: 108
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #10 on: January 05, 2018, 01:17:22 am »
AMD, Arm also affected by data-leak design blunders

Two different exploits nota bene, only one ARM version affected by the same exploit as the Intel one.

The exploit that hits the PowerPC 8 & 9, PPC Z/OS and AMD FX chips is both much more difficult to exploit and can be fixed in software with no performance penalty.

P.S. Microsoft has already issued a fix for the AMD FX in their latest update package, no performance degaration.
« Last Edit: January 05, 2018, 01:19:18 am by Olafur Gunnlaugsson »

Greg Pringle

  • Jr. Member
  • **
  • Thank You
  • -Given: 4
  • -Receive: 2
  • Posts: 97
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #11 on: January 05, 2018, 04:22:12 pm »
It would seem without the specifics on the problem and how software can exploit it then all the comments above are pure speculation.

Ian Manners

  • Global Moderator
  • Sr. Member
  • *****
  • Thank You
  • -Given: 34
  • -Receive: 24
  • Posts: 279
  • I am the computer, it is me.
    • View Profile
    • ComKal Networks Australia
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #12 on: January 05, 2018, 06:59:49 pm »
A good write up, as of what I have currently found is at:-

https://semiaccurate.com/2018/01/04/kaiser-security-holes-will-devastate-intels-marketshare/

I am having a problem in getting my head around how these problems occur and transcribing them to how OS/2 manages it's memory, to soon after Christmas :o)

It would at least require someone to write the software to target an OS/2 box, and some means to get it delivered.
Cheers
Ian B Manners

Dave Yeo

  • Hero Member
  • *****
  • Thank You
  • -Given: 8
  • -Receive: 100
  • Posts: 1384
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #13 on: January 05, 2018, 07:27:34 pm »
Yea, my understanding is that the way OS/2 manages its memory, getting access to kernel memory isn't that big of a deal as we don't have permissions or sandboxes so just need to read a different tabs memory or even the swap file if one exists.
As for the code, it seems to have to be tight assembler, which, as you say, has to target OS/2 and be delivered.
There is a proof of concept using Chromes JavaScript JIT but even that would have to be targeted as there are many code paths in the JIT depending on CPU etc.
The real problem is in data centres and such as this allows escaping from a virtual machine or/and getting roots password.

Olafur Gunnlaugsson

  • Full Member
  • ***
  • Thank You
  • -Given: 27
  • -Receive: 8
  • Posts: 108
    • View Profile
Re: OS/2 kernel requiring speculative execution patch!!!!
« Reply #14 on: January 06, 2018, 09:52:49 pm »
This link has a rather frightening graphic from Epic Games that shows the performance hit for their servers after a patch had been applied

https://www.epicgames.com/fortnite/forums/news/announcements/132642-epic-services-stability-update