Arm CPUs Impacted by Straight-Line Speculation (SLS) Vulnerability

[AleksandarK]

When Spectre and Meltdown were discovered, the whole industry got on its legs and started to question CPU security more seriously. There are a plethora of attacks that exploit the CPU function called branch prediction, which predicts paths of code execution so it can ready them and execute them faster. This approach is one part of the microarchitectural techniques used to add performance to the CPU design. However, nothing comes without a cost. Despite adding more performance, the branch prediction had taken a toll on the security of CPUs, making them vulnerable to side-channel attacks. Spectre and Meltdown where both discovered in 2018 and they impact millions of CPUs around the world.

Today, a new side-channel vulnerability was discovered, and on Arm CPUs. Called the Straight-Line Speculation (SLS), the speculation bug is haunting all of Arm Armv-A based processors. This represents a wide range of devices being powered by these CPUs, so Arm is taking action to prevent it. The way SLS works is that whenever there is a change in instruction flow, the CPU just starts processing instructions found linearly in memory, instead of changing the path of flow. This action is resulting in a new SLS vulnerability marked as CVE-2020-13844. The vulnerability was discovered by Google SafeSide project last year and they have reported it to Arm. In the meantime, Arm was working on a fix and they already send them upstream to important operating systems and firmware suppliers so it can be resolved. Arm says that the chances of this attack are low, however, they can not be dismissed.


View at TechPowerUp Main Site

 

[AsRock]

This effect AMD's PSP ?.

 

[AleksandarK]

This effect AMD's PSP ?.

I don't know much about AMD's PSP. I don't see it being mentioned anywhere with this bug so i think it is safe. If i find anything i will report on it.

 

[Caring1]

"new SLS vulnerability marked as CVE-2020"

I see that as Covid 2020
Even CPUs aren't immune.

 

[silentbogo]

Some sources only mention ARMv8, but apparently there are some ARMv7a cores affected as well

Documentation – Arm Developer

developer.arm.com

https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/straight-line-speculation

 

[Vayra86]

"new SLS vulnerability marked as CVE-2020"

I see that as Covid 2020
Even CPUs aren't immune.

I suppose that's two weeks of no internet for it!

 

[R-T-B]

This effect AMD's PSP ?.

It's arm based but it's so locked down I don't know how you'd execute the exploit. It'd be hard as hell, but once someone figures it out: Yes, certainly. It fits the bill to be affected.

 

[silentbogo]

It's arm based but it's so locked down I don't know how you'd execute the exploit. It'd be hard as hell, but once someone figures it out: Yes, certainly. It fits the bill to be affected.

If PSP is still just a straightforward Cortex-A5, then it's not affected (so far).
Though, there are still exploitable holes in PSP firmware (and many undiscovered, since it's closed-source and barely documented).

 

[R-T-B]

If PSP is still just a straightforward Cortex-A5, then it's not affected (so far).

Thought it was an Armv7A. Might be wrong (probably am, actually).

and many undiscovered, since it's closed-source and barely documented

#ThanksQualcomm

 

[silentbogo]

Thought it was an Armv7A.

Cortex-A5 is ARMv7-a. But that's for older CPUs/APUs. With Zen it's probably running on magic unicorns, cause once again - no one knows/secret/proprietary/undocumented.

 

[remixedcat]

ARM based router SoCs anyone?

 

[R-T-B]

With Zen it's probably running on magic unicorns, cause once again - no one knows/secret/proprietary/undocumented.

It's based on a quqlcomm TrustZone solution from smartphoneland, which is designed to run on lowend reference arm cores.

Honestly, I'd be shocked if it wasn't.

ARM based router SoCs anyone?

Inefficient for routing, but through enough Ghz at the problen and they work. I had a marvell based one that ran around 1gbps on my line no prob, albeit at 2Ghz core clock...

 

[remixedcat]

I meant are they affected by this??