Anon4 (no.delete@this.example.com) on July 14, 2022 2:17 pm wrote:
> anon2 (anon.delete@this.anon.com) on July 13, 2022 10:03 pm wrote:
> > anonymous2 (anonymous2.delete@this.example.com) on July 13, 2022 3:14 pm wrote:
> > > https://en.wikipedia.org/wiki/Retbleed
> >
> > Does not seem to be anything new in hardware just spectre variant 2 software fix in Linux was not complete.
>
> Variant 2 was against forward jump instructions, the mitigation was to turn forward jumps in to returns
> which are architecturally similar but have a very different effect on the microarchitecture.
>
> This was 'retpoline' retbleed attacks the retpoline itself in a similar way to
> the way variant 2 attacked jumps. It makes use of the fact that returns start behaving
> like jumps when certain internal state is overflowed. So this is novel.
>
> Anything which uses retpolines is vulerable and that includes
> Windows and possibly macOS it's not just a Linux issue.

Unclear for macOS. The branch security tags patent
(2018) https://patents.google.com/patent/US20200192672A1
is easily extended to the return stack, and in fact Ampere have a specific patent to that effect (using a grossly simplified security tag)
(2020) https://patents.google.com/patent/WO2022031816A1

So to some extent it boils down to some question of
(a) did Apple, after the initial patent, think of RAS as one more predictor that should be protected in this way?
(b) are these sorts of HW security mitigations considered strategic, and jealously guarded (so Apple and Ampere [and ARM and Intel...] don't talk)? Or is this considered a communal problem, and at the point that Ampere realized this was worth doing, they mentioned it to Apple, Arm, Intel, etc?