-
Notifications
You must be signed in to change notification settings - Fork 89
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Results #1
Comments
CPU: Results: |
CPU: Result: |
OS:
Windows Subsystem for Linux: CPU
Results (CACHE_HIT_THRESHOLD = 80):
|
OS CPU RESULT (CACHE_HIT_THRESHOLD 80) |
OS: CPU:
RESULT (CACHE_HIT_THRESHOLD 80):
|
Using my pull request (#2). OS:
CPU:
RESULT (CACHE_HIT_TRESHOLD 80):
Doesn't seem a robust as other CPU's result, the vulnerability is clearly there though. |
OS
CPU
Result
|
CPU
OS (slackware-current)
ResultUsing
|
OS (Debian Stretch) CPU
Result
|
OS (Debian Sid 2018-01-05) CPU
Result
Am I reading the output wrong or is this R5-1400 more susceptible to Spectre than my i7-2600 above? Edit: OS (Debian Sid 2018-01-05) CPU
Result
|
OSDarwin h3adsh0tzzs-MBP.home 16.7.0 Darwin Kernel Version 16.7.0: Thu Jun 15 17:36:27 PDT 2017; root:xnu-3789.70.16~2/RELEASE_X86_64 x86_64 CPUmachdep.cpu.brand_string: Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz Result #define CACHE_HIT_THRESHOLD (80)Reading 40 bytes: |
OS
CPU
Results (CACHE_HIT_THRESHOLD = 80)
|
OS (Debian Testing)Linux [hostname] 4.14.0-2-amd64 #1 SMP Debian 4.14.7-1 (2017-12-22) x86_64 GNU/Linux CPUvendor_id : AuthenticAMD Results #define CACHE_HIT_THRESHOLD (250)Reading 40 bytes: |
With @progman patch from original gist and OSLinux notebook 4.14.8-1-ARCH #1 SMP PREEMPT Wed Dec 20 21:27:44 UTC 2017 x86_64 GNU/Linux CPUvendor_id : GenuineIntel ResultReading 40 bytes: |
OS
CPU
Result
|
OS Linux [hostname] 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux CPU vendor_id : GenuineIntel
cpu family : 6
model : 42
model name : Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
stepping : 7
microcode : 0x29
cpu MHz : 894.574
cache size : 3072 KB Results (CACHE_HIT_THRESHOLD = 80) Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfebb8... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfebb9... Success: 0x68=’h’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebba... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfebbb... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfebbc... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfebbd... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfebbe... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfebbf... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfebc0... Success: 0x63=’c’ score=11 (second best: 0x00 score=2)
Reading at malicious_x = 0xffffffffffdfebc1... Success: 0x20=’ ’ score=15 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdfebc2... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfebc3... Success: 0x6F=’o’ score=155 (second best: 0x05 score=75)
Reading at malicious_x = 0xffffffffffdfebc4... Success: 0x72=’r’ score=7
Reading at malicious_x = 0xffffffffffdfebc5... Success: 0x64=’d’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebc6... Success: 0x73=’s’ score=17 (second best: 0x05 score=6)
Reading at malicious_x = 0xffffffffffdfebc7... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfebc8... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfebc9... Success: 0x72=’r’ score=9 (second best: 0x00 score=3)
Reading at malicious_x = 0xffffffffffdfebca... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfebcb... Success: 0x20=’ ’ score=15 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdfebcc... Success: 0x53=’S’ score=15 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdfebcd... Success: 0x71=’q’ score=301 (second best: 0x05 score=148)
Reading at malicious_x = 0xffffffffffdfebce... Success: 0x75=’u’ score=15 (second best: 0x05 score=5)
Reading at malicious_x = 0xffffffffffdfebcf... Success: 0x65=’e’ score=7 (second best: 0x86 score=1)
Reading at malicious_x = 0xffffffffffdfebd0... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfebd1... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfebd2... Success: 0x69=’i’ score=97 (second best: 0x05 score=46)
Reading at malicious_x = 0xffffffffffdfebd3... Success: 0x73=’s’ score=17 (second best: 0x00 score=7)
Reading at malicious_x = 0xffffffffffdfebd4... Success: 0x68=’h’ score=15 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdfebd5... Success: 0x20=’ ’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebd6... Success: 0x4F=’O’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebd7... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfebd8... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfebd9... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfebda... Success: 0x66=’f’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebdb... Success: 0x72=’r’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebdc... Success: 0x61=’a’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebdd... Success: 0x67=’g’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebde... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfebdf... Success: 0x2E=’.’ score=17 (second best: 0x05 score=6) |
OS
CPU
Results (CACHE_HIT_THRESHOLD = 500)
|
OS:
CPU:
Result:
Hmm, does not seem to hit every letter correctly... interesting. |
Kernel CPU
Results with #define CACHE_HIT_THRESHOLD (221)
|
OS
CPU
Result
NOTEWith parameter |
OS
CPU
Results (default THRESHOLD)
|
OS and CPU
Ubuntu artful with all updates Results
With lowest threshold:
|
OS and CPU processor : 0 Result
|
OS
CPU
Results
|
OS
CPU
Results (default THRESHOLD)
|
OS
CPU
Results
|
OS
CPU
Results
|
OS: Windows 10 Enterprise 1709 x64 (build 10.0.16299) CPU: Intel(R) Core(TM) i5-2500T @ 2,3 GHz (SandyBridge) compiled with VS2017, I get the following output:
Scared now, since Intel(R) offers no BIOS updates for my Intel(R) DesktopBoard(TM) any more, it is EOL since a few days - coincidentally. :/ edit - well, i even get 100% success rate on a fully patched system (which should not be vulnerable according to the powershell module offered by microsoft) with this PoC, so either this PoC doesn't produce meaningful results, or the MS test is wrong and/or their patches don't help against Spectre. Interesting side note: the PoC EXE is recognized by Windows Defender as "exploit:spectre.a". |
$ uname -a
$ make -B; ./spectre.out
$ CFLAGS=-DNORDTSCP make -B; ./spectre.out
$ ./spectre.out 400
It seems the the attack does not work on Pentium Dual Core E5200. This is in agreement with https://www.intel.com/content/www/us/en/architecture-and-technology/facts-about-side-channel-analysis-and-intel-products.html#4 |
OS
CPU$ lscpu
ResultsCACHE_HIT_THRESHOLD = 80$ ./spectre.out
CACHE_HIT_THRESHOLD = 300$ ./spectre.out 300
CACHE_HIT_THRESHOLD = 1200$ ./spectre.out 1200
These results suggest that the AMD Phenom(tm) II X4 965 is not vulnerable. |
OS:
CPU:
Results: ./spectre
./spectre 300
|
OSFedora 27
CPU
ResultsCACHE_HIT_THRESHOLD = 80
NOCLFLUSH
|
OSWindows 8.1 Professional x64 CPUIntel(R) Core(TM) i3-2370M @ 2,40 GHz (SandyBridge) ResultsCompiled with VS2015 32-bit
Compiled with VS2015 32-bit, NOCLFLUSH
Compiled with VS2015 64-bit
Compiled with VS2015 64-bit, NOCLFLUSH
|
ArchLinux, Lenovo Ideapad Z575 laptop
|
OS ( uname -a ) CPU
Results (CACHE_HIT_THRESHOLD = 100):
|
Kernel
Processor
Results./spectre.out 115
./spectre.out
As an addendum, this processor is undervolted, and overclocked, stock is 3.7 GHz with 4.0 GHz boost, this one has 4.2 GHz as its highest scaling frequency via an increased multiplier. Results were much the same at stock, though I think it might have needed a cache hit threshold of 120 at stock. |
OS
CPU
Resultsspectre.out Version: commit d8ff068
|
./spectre.out 160 AMD Opteron(tm) Processor 4386 |
TL;DR: "We're all fucked. I'm fucked. You're fucked. The whole department's fucked. It's been the biggest cock-up ever and we're all completely fucked." - Andrew Rawnsley This is how low can my cpu go. (By that, I mean below that number and it just shows ?s.)
|
Thank you!Thank you for spiffing up the example code in the paper to the point where I can simply run
and have it work. A great community service. My results are below! OSLinux dmh 3.13.0-39-generic #66-Ubuntu SMP Tue Oct 28 13:30:27 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux CPU
Results
|
In April 2018 Intel released an updated micro-code for Sandy Bridge. Nevertheless, this PoC is still functional, only now the threshold must be greater (150 instead of 80). OSWindows 8.1 Professional x64 CPUIntel(R) Core(TM) i3-2370M @ 2,40 GHz (SandyBridge) VS2015 Community 32-bit
VS2015 Community 64-bit
|
OSLinux SB2-RYAN 4.4.0-43-Microsoft #1-Microsoft Wed Dec 31 14:42:53 PST 2014 x86_64 GNU/Linux CPU
Results
|
OS
CPU
Results
|
OS
CPU
RESULTS
Works well for CH thresholds of 35 and higher |
Many years, BIOS updates and Windows updates later. OSWindows 10 Enterprise 22H2 19045.3693 x64 CPUIntel(R) Core(TM) i3-7100 @ 3,90 GHz (KabyLake) Visual Studio 2017 Community x64
Visual Studio 2017 Community x32
|
OS
Linux 4.9.0-4-amd64 #1 SMP Debian 4.9.65-3+deb9u1 (2017-12-23) x86_64 GNU/Linux
CPU:
Results (CACHE_HIT_THRESHOLD = 300):
The text was updated successfully, but these errors were encountered: