Hacking Spectre bug affecting the Switch?

chippy

Well-Known Member
OP
Member
Joined
Dec 21, 2017
Messages
321
Trophies
0
Age
124
XP
967
Country
Australia
so the news of bugs in CPU's coming out atm have some serious issues

meltdown wont affect the switch but Spectre affects ARM processors so the switch could be affected.

"The paper describes using speculation around, for example, array bounds checks and branches instructions to leak information, with proof-of-concept attacks being successful on AMD, ARM, and Intel systems. Spectre attacks can be used both to leak information from the kernel to user programs, but also from virtualization hypervisors to guest systems."

more can be read here
https://arstechnica.com/gadgets/201...odern-processor-has-unfixable-security-flaws/
 
  • Like
Reactions: zoogie

zoogie

playing around in the end of life
Developer
Joined
Nov 30, 2014
Messages
8,560
Trophies
2
XP
14,998
Country
Micronesia, Federated States of
If someone made a switch version of that cute little spectre ghost I'd be so happy :P

spectre-text.png


I wonder if that little ghost intends to flog us with that little switch in its hand ;p

edit:

spectre-text2.png
I have way too much time on my hands as you can see XD
 
Last edited by zoogie,

chippy

Well-Known Member
OP
Member
Joined
Dec 21, 2017
Messages
321
Trophies
0
Age
124
XP
967
Country
Australia
I am asking about "Spectre" NOT Meltdown.
they are 2 different cpu issues that have come out in the news in the past few days.

meltdown affects intel cpus only
Spectre affects ARM, AMD and Intel CPU's
 

Astoria

Well-Known Member
Member
Joined
Aug 26, 2009
Messages
658
Trophies
1
XP
1,271
Country
Costa Rica
Yes. Spectre affects pretty much everything.

However, it's very hard to exploit. And there are easier ways for kernelhax in Switch.
 

Selver

13,5,1,14,9,14,7,12,5,19,19
Member
Joined
Dec 22, 2015
Messages
219
Trophies
0
XP
426
Country
... meltdown wont affect the switch but Spectre affects ARM processors so the switch could be affected.

TLDR: YES to both Spectre and a slight variation of Meltdown.

Summarization so far:
  • Spectre includes two vulnerabilities, which ARM describes as Variant 1 and Variant 2.
  • Meltdown is officially one vulnerability which ARM describes as Variant 3, and they ARM describes a slight variation they call Variant 3A.
  • The Cortex A57 is susceptible to Variants 1, 2 (Spectre), and to 3A (Meltdown variant for system registers)
  • The Cortex A57 is NOT susceptible to Variant 3 (Meltdown proper).
  • ARM themselves released proof-of-concept code for each variant.
Impact:
  • Meltdown provides an arbitrary read primitive of any memory that is mapped in the page tables, even if permissions would prevent it's use (e.g., different ASID/PCID, being marked as only accessible via kernel-mode/EL1, etc.)
  • The Meltdown Variant 3A allows reading of EL1 (kernel-mode) system registers from EL0 (user-mode) processes. This can be used to break KASLR, but switch isn't using KASLR. It's unclear what other system registers are of particular interest in the switch at the moment
  • Spectre provides an arbitrary read primitive similar to Meltdown, but uses predictive out-of-bounds array loads and EL0 (usermode) seeding of branch prediction to use existing EL1 (kernel) code to do the dirty work (avoiding need for Meltdown's speculative load of data that is not accessible, as EL1 can legally speculatively access EL1 pages...)
  • ARM Trusted Firmware appears to further be vulnerable to Variant 2, but no vulnerable code patterns have yet been disclosed for Variant 1, limiting the application of Spectre against TrustZone on Switch at this time.
  • It's not currently clear if/how Meltdown (Variants 3 and 3A) would be applied to EL3 (TrustZone).
 
Last edited by Selver, , Reason: Fix impact to clarify meltdown vs spectre

chippy

Well-Known Member
OP
Member
Joined
Dec 21, 2017
Messages
321
Trophies
0
Age
124
XP
967
Country
Australia
thanks for the info Selver I didn't think Meltdown (or variants) affected anything other then intel cpu's so that's interesting to learn.
more stuff I can look into to satisfy my curiosity
 
  • Like
Reactions: Selver

_______

 
Member
Joined
May 13, 2016
Messages
515
Trophies
0
XP
834
Country
Japan
Based on some tests/reports, games on PC are not affected.....

It's not about the games. If you have execute privilege, you could have make it work as long as the chip was affected.

Google said that they haven't found a commercial application that could trigger this, but you can write your own. (Still we need userland execute privilege, which we normally don't have on consoles by default.)
 
  • Like
Reactions: TotalInsanity4

Selver

13,5,1,14,9,14,7,12,5,19,19
Member
Joined
Dec 22, 2015
Messages
219
Trophies
0
XP
426
Country
Previously, I wrote:
... It's unclear what other system registers are of particular interest in the switch at the moment ...

Here's some system registers that MIGHT be of interest, if you want to understand the configuration of the system:
However, even though Meltdown is conceptually easier to understand, it appears that Variant 3A may be of limited use on the Switch.

Spectre, although conceptually mind-bending, appears more likely to provide insight into the inner workings of the system. However, the technical expertise required to understand and implement it reduces the number of developers who could do so to small number... Read and understand first the Meltdown exploit, and only then consider Spectre. I wouldn't claim to fully understand it... One of those variants appears to allow an attacker to cause speculative execution to select an attacker's selected gadget as the speculated jump point ... thus speculatively executing random (existing) code gadgets ... which cache side-channels then expose the value used in those speculative executions ... brain melt down... .
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • LeoTCK @ LeoTCK:
    good night
  • BigOnYa @ BigOnYa:
    Nighty night. I messed up, made a margirita but used vodka by accident, taste like shit, but can't bring myself to dump it
  • BigOnYa @ BigOnYa:
    Alright I'm out too, gonna go shoot some 8-ball with the old lady. Good Night all!
  • HiradeGirl @ HiradeGirl:
    G Night
  • NinStar @ NinStar:
    game night
  • wolffangalchemist @ wolffangalchemist:
    Today I learned that raz disposable vapes have 0.96 inch i2c oled screens in them that can be used with various mcu's. I will be getting a bunch from. My coworkers now I j
  • wolffangalchemist @ wolffangalchemist:
    Just need a project to use them in.
  • K3Nv2 @ K3Nv2:
    @BigOnYa watches porn on his vape
  • wolffangalchemist @ wolffangalchemist:
    I made the same joke about a hour ago lol
    +1
  • wolffangalchemist @ wolffangalchemist:
    Seriously co worker said he has like 20 or so of these exact vapes that are empty, I am gonna have a lot of screens and USB c ports.
    +1
  • K3Nv2 @ K3Nv2:
    Use them for meth also
  • SylverReZ @ SylverReZ:
    @K3Nv2, Can it run Crysis?
  • Sicklyboy @ Sicklyboy:
    Holy shit I'm finally below 900 tabs open in Chrome
  • K3Nv2 @ K3Nv2:
    @Sicklyboy, All porn?
  • Sicklyboy @ Sicklyboy:
    >500 of it is youtube videos, so not all porn
  • K3Nv2 @ K3Nv2:
    Good lad
  • wolffangalchemist @ wolffangalchemist:
    i will make a tiny psp and put porn it.
  • NinStar @ NinStar:
    I totally forgot I was a stacked transsexual anthropomorphic bunny on steam
  • BakerMan @ BakerMan:
    ...
  • BakerMan @ BakerMan:
    what the fuck?
  • BakerMan @ BakerMan:
    also, going to bed
  • DinohScene @ DinohScene:
    feckin spambots
  • K3Nv2 @ K3Nv2:
    Wine and dine the spambots before you do that
  • DinohScene @ DinohScene:
    they better pay up
  • K3Nv2 @ K3Nv2:
    They might have grandma's 401k
    K3Nv2 @ K3Nv2: They might have grandma's 401k