SLAP and FLOP mitigation

D

dada_dave

Elite Member
Joined
Oct 25, 2022
Posts
3,371
Hector is often fairly scathing towards security researchers, but in this case he seems to be saying that the two vulnerabilities discovered by researchers already have the appropriate mitigations in hardware, are part of the spec, and it’s effectively a software bug in the browsers not to use them rather than a hardware fault.

Hector Martin (@marcan@treehouse.systems)

HA, so here's why I couldn't reproduce SLAP. m1n1 accidentally turns off the SSBS bit in PSTATE on EL0 calls. It defaults to 1 on CPU startup. [SSBS: Speculative Store Bypass...
social.treehouse.systems social.treehouse.systems
 
dada_dave said:
Hector is often fairly scathing towards security researchers, but in this case he seems to be saying that the two vulnerabilities discovered by researchers already have the appropriate mitigations in hardware, are part of the spec, and it’s effectively a software bug in the browsers not to use them rather than a hardware fault.

Hector Martin (@marcan@treehouse.systems)

HA, so here's why I couldn't reproduce SLAP. m1n1 accidentally turns off the SSBS bit in PSTATE on EL0 calls. It defaults to 1 on CPU startup. [SSBS: Speculative Store Bypass...
social.treehouse.systems social.treehouse.systems
Click to expand...

Yep. Just read the thread and looked at prior discussion of those bits. If you are running untrusted code in your own process, you should set the bits appropriately.
 
Back
Top