Oh no.

    • Gsus4@feddit.nl
      link
      fedilink
      English
      arrow-up
      24
      arrow-down
      2
      ·
      1 year ago

      No luck, it’s a systemic issue (practice):

      Update: Intel’s Downfall was closely followed by AMD’s Inception, a newfound security hole affecting all Ryzen and Epyc processors. The first independent testing of the mitigation microcode patches show that it can drastically lower performance in certain workloads. We’ve included details throughout this post.

      • r00ty@kbin.life
        link
        fedilink
        arrow-up
        6
        ·
        1 year ago

        Is that the same as zenbleed or in addition? How easy zenbleed was to test and the kind of information gained was terrifying.

        • Gsus4@feddit.nl
          link
          fedilink
          English
          arrow-up
          5
          arrow-down
          1
          ·
          edit-2
          1 year ago

          yea, it’s another one https://www.xda-developers.com/amd-inception/ :/

          Inception differs from other transient execution attacks by inserting new predictions into the branch predictor during the transient window, creating more powerful transient windows that can be used to overflow the Return Stack Buffer and gain control of the CPU. Mitigating the impact of this attack is apparently challenging.

          In the wake of Zenbleed, researchers from ETH Zurich have designed a new class of transient execution attacks, dubbed Training in Transient Execution (TTE). Using TTE, the researchers built an end-to-end exploit called Inception. It can leak kernel memory at a rate of up to 39 bytes per second on AMD Zen 4, and the researchers were able to leak /etc/shadow on a Linux machine in 40 minutes. This file contains hashed user account passwords and is safeguarded by the system, only accessible by the root user. In other words, this exploit is really bad.

          • r00ty@kbin.life
            link
            fedilink
            arrow-up
            3
            ·
            1 year ago

            Damn. I just recently patched up my dedicated box for zenbleed. This seems far worse.

            I mean I’m not going to be a high value target. But still, this isn’t looking good for either chip maker right now.

            • ultranaut@lemmy.world
              link
              fedilink
              English
              arrow-up
              5
              ·
              1 year ago

              My understanding is the newest AMD bug is probably not too much of an issue because it’s very limited in how much data it can leak at a time and there’s no way to target it at specific data so if you wanted to use it to do something like grab a password it’s extremely unwieldy and not really practical.