1938: Meltdown and Spectre

|< < Prev Comic #1938 (January 5, 2018) Next > >|

Meltdown and Spectre

Title text: New zero-day vulnerability: In addition to rowhammer, it turns out lots of servers are vulnerable to regular hammers, too.

Explanation

This comic was inspired by the Meltdown and Spectre bugs found in certain processors; these vulnerabilities were disclosed to the public in the week of this comic. The bugs result from flawed implementations of speculative execution, and made big news because they broke the "walls" between programs executing concurrently on the same computer, in some circumstances allowing malware to steal secrets from normal, bug-free programs.

Speculative execution is a technique used to speed up the execution of computer programs. Processors handle instructions in a series of steps, like an assembly line. The processor works on several successive instructions, each at a different stage in the assembly line. It may start speculatively executing instructions that follow a particular result of a decision before the execution of the logic that makes that decision is finished. Once the decision is made, it keeps results from the selected path, and discards unnecessary results. This allows it to keep doing useful work while some slower decision is made.

In the Meltdown and Spectre bugs, the results of speculatively executed instructions are not completely discarded, allowing them to affect things that the program logic should have prevented.

Ponytail uses the Trolley Problem, and trolley (tram) tracks in general, as an analogy for streams of instructions in a program. The Trolley Problem is a thought experiment where an out-of-control trolley is heading to a switch which you control. Leaving the switch as-is will cause it to kill multiple people (typically five) stuck on the tracks, but switching the track will cause it to kill only one person, who would not have died if the switch was left untouched. This creates the ethical dilemma of passively causing multiple deaths, versus actively causing one. The Trolley Problem has gained significant memetic traction, helped in no small part by its frequent inclusion in “introduction to philosophy” type courses. The problem has seen revitalized interest with the emergence of autonomous cars, which may be faced with what are, essentially, such choices in emergency situations.

As an analogy for multiple mutually exclusive paths being executed at the same time, Ponytail invokes certain interpretations of quantum mechanics, where quantum-level particles can be viewed as taking every possible path at once, with the result being the sum of all of them. This is an idea popularized by the common interpretation of Schrödinger's cat, where the cat is both dead and alive until some event results in one of the states being selected.

The phantom trolley driving through walls is an analogy for the computer instructions being able to access areas of memory that should be protected from them. This may also be a reference to quantum tunnelling, or even simply a joke about the phantom trolley being a literal phantom, i.e. incorporeal.

In many cases, contrary to what the comic implies, both paths are not taken simultaneously during speculative execution. A branch predictor may be used to select the most likely path, and the effects should be completely erased if the predicted path is incorrect. To use Ponytail's analogy, a phantom trolley is sent down one path (hopefully the most likely one), and either becomes real once it's determined that that path was correct, or vanishes and is replaced by a real trolley starting down the other path from the branching point. Both branch prediction and taking both paths (known as eager evaluation) are considered speculative execution and are affected by these bugs.

The Row hammer problem had been known for many years before this comic was published. A common form of computer memory is constructed from tiny capacitors organized in a two-dimensional grid of rows and columns. Capacitors store charge to represent information. By applying a pattern of memory access that rapidly changes a row of capacitors, you can cause charge to overflow to nearby rows and incorrectly change their states.

Ponytail mentions that we especially suck at building "shared computers" because Row hammer, Spectre, and Meltdown all break down the security divisions built between programs and between users. A hacker running a separate program in a separate account shouldn't be able to access your data or change the behavior of your program, but these problems allow them to. This is particularly dangerous for time-sharing, servers, and the cloud, where different programs, websites, or even companies can be sharing the same hardware.

Cueball takes her explanation literally, and comes to the conclusion that the cloud "is full of phantom trolleys armed with hammers", and Ponytail cannot be bothered correcting him (it could also be, considering xkcd's absurdist humor, that this quite literally is the case in the comic's world, and Ponytail is telling Cueball that he is indeed correct). Cueball's final line ironically suggests that these exploits can be repaired with a simple software update. This seems to be mocking the naive misunderstanding that software can make up for flawed hardware. However, the exploits discussed in this comic are not trivial oversights, but reflect fundamental issues in the design of modern processors.

A zero-day vulnerability is an attack that takes advantage of a vulnerability that hasn't been published yet, and so is not patched in any vulnerable system. The title text suggests that, until it was 'disclosed' here, nobody was aware that as well as Row hammer, computer servers can also be harmed by regular hammers. In reality, this would be obvious to most people.^{[citation needed]} One might "patch" a server against this attack by plating it with stronger metal.

Transcript

[Zoom out with Cueball and Ponytail walking to the right on the ground.]

Cueball: The Meltdown and Spectre exploits use "speculative execution?" What's that?

Ponytail: You know the trolley problem? Well, for a while now, CPUs have basically been sending trolleys down both paths, quantum-style, while awaiting your choice. Then the unneeded "phantom" trolley disappears.

[Zoom in on only Ponytail who has turned towards Cueball off-panel left.]

Ponytail: The phantom trolley isn't supposed to touch anyone. But it turns out you can still use it to do stuff.

Ponytail: And it can drive through walls.

[Cueball and Ponytail, lifting both her palms up, are standing, facing each other.]

Cueball: That sounds bad.

Ponytail: Honestly, I've been assuming we were doomed ever since I learned about Rowhammer.

[In a frame-less panel they continue talking, both with their arms down.]

Cueball: What's that?

Ponytail: If you toggle a row of memory cells on and off really fast, you can use electrical interference to flip nearby bits and—

Cueball: Do we just suck at...computers?

Ponytail: Yup. Especially shared ones.

[Zoom out again as they resume walking to the right on the ground. Cueball is lifting his smartphone up and looks at the screen.]

Cueball: So you're saying the cloud is full of phantom trolleys armed with hammers.

Ponytail: ...Yes, that is exactly right.

Cueball: Okay. I'll, uh... install updates?

Ponytail: Good idea.

Trivia

Although this is clearly not part of the series Code Quality, it might be the same two characters, with Ponytail again displaying a much better understanding of computers than Cueball with his Computer Problems.

The Trolley problem was mentioned a month before this comic in the last milestone on this list in 1925: Self-Driving Car Milestones; see more there regarding why this problem might have resurfaced in xkcd. Three years before that comic, a comic was even named after the problem: 1455: Trolley Problem.

The fact that compromising IT systems is sometimes easier done physically than logically is also mentioned in 538: Security.

 add a comment! ⋅  add a topic (use sparingly)! ⋅  refresh comments!

Discussion

The "trolley problem" is the ethical dilemma thought experiment where an out-of-control trolley is heading to a junction (which you have control over) - to one side it'll kill one group of people - to the other, some others. Your moral dilemma is deciding which is the "best" outcome (eg, hitting a dozen five year old children or three Nobel laureats). This is like a software "if" statement. Speculative execution in most CPU chips is where the computer always takes both sides of a decision like this - explores what will happen down each path - and only causes the effects of the decision to happen when the decision as to which way to proceed is decided. This allows it to keep on doing useful work while some slower decision is made. The "quantum" aspect of this is that in some versions of quantum theory, quantum-level particles take every possible path at once and the result is the sum of all of them.

In a sense, the computer is exploring the consequences of the trolley problem in a quantum-like manner.

There's so much wrong with this sentence. You totally did it intentionally. 108.162.216.118 05:56, 7 January 2018 (UTC)

You shouldn't comment in the middle of someone's comment. :) NiceGuy1 (talk) 06:23, 9 January 2018 (UTC)

This would all be OK if it were not for the fact that devious black-hat hackers can come up with devious ways to see the information that should have been discarded in the "path-not-taken". So even though the computer will eventually decide that some piece of information should not be accessible - you can find out the value it would hypothetically read - even though it will soon decide that it should not access the information.

The "rowhammer" problem is something entirely different. Computer memories are organized as a two-dimensional grid of rows and columns - and are physically constructed from tiny capacitors. If you apply just the RIGHT pattern of rapid changes to one row of the grid, you can cause one of the capacitors on the next row to incorrectly change state. This is a design flaw in the memory chip - and it allows (in some circumstances) programs to change data in memory locations that they have no right to change.

SteveBaker (talk) 19:33, 5 January 2018 (UTC)

uhhh did you just copy and paste your entire edit into talk? DPS2004'); DROP TABLE users;-- (talk) 20:19, 5 January 2018 (UTC)

Pretty much. When I got here, there was no information about the comic at all. Since I'm unfamiliar with all of the other stuff that goes into an explain, I left it as a comment so someone else could use it...but after a while, nobody did, so I copy-pasted it into the explanation...with some tweaks! Sorry if that was a faux-pas of some variety! SteveBaker (talk) 21:53, 5 January 2018 (UTC)

What? Servers are vulnerable to actual hammers? Huh, do you suppose they're be vulnerable to an actual trolley as well? I have a spare server, does anyone have a spare trolley? ~~ SiliconWolf

My server is actually mounted inside a trolley - precisely to avoid this kind of issue. SteveBaker (talk) 23:02, 5 January 2018 (UTC)

I wouldn't recommend that. A collision would anger the honeybees. ~AgentMuffin

Do you think we can put a quantum computer in a trolley and ask the ghost in the shell to chase down the one causing the above vulnerabilites? 141.101.69.87 11:05, 8 January 2018 (UTC)

The most helpful technical explanation I’ve found is here: https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/ ;the comments also provide useful clarification. PotatoGod (talk) 02:54, 6 January 2018 (UTC)

Could an explanation be added as to what a trolley is? Being in the UK, my first thought was that of a shopping trolley (US: Shopping cart). Over here, we call trollies "trams" 162.158.34.4 11:39, 6 January 2018 (UTC)

The analogy is the same, just the speed and engine that changes. 162.158.74.9

...As does the lethality... I expect the worst case scenario to be a bruised hip. In fact I'd send a shopping cart at the 5 people, they'd have a greater chance of stopping it without harm. :) NiceGuy1 (talk) 04:09, 7 January 2018 (UTC)

Actually, I find "trolley" to be a very UK word. Outside of this Trolley Problem I never hear it here in North America. Without looking it up, I would expect the mere name means it probably was thought up in the UK in the fist place, or by someone using UK English to name it. Only other term I can think of right now is "streetcar", but I never hear that either. Blanking on what they usually are called (perhaps "tram" as well), but they don't have any anymore in my city. This commonality of terms might be different in cities equipped with them. :) NiceGuy1 (talk) 04:09, 7 January 2018 (UTC)

I totally expected "Schrodinger's Cat's Cat" to be a popular meme, but apparently it is not. Google search I hereby claim it.These Are Not The Comments You Are Looking For (talk) 08:18, 7 January 2018 (UTC)

The explanation assumes Cueball is taking Ponytail's comment litteraly while she agrees with him because of the humor. To me it rather looked like Cueball was making a joke that Ponytail agreed to. The fact that he said "The Cloud" would confirm this view IMHO, as he deliberatly chose another metaphor to push the silly image even further. 141.101.69.87 11:05, 8 January 2018 (UTC)

Cueball is speaking as a computer know-nothing. Hence, asking for such an explanation, and hence her explanation being in more layman's terms. This seems to indicate that his summation is his attempt to try to appear not ENTIRELY stupid and trying to weakly sum up her explanation - and use a buzzword he knows, "Cloud", to further sell the idea that he understands. To me, Ponytail agrees more as a form of "Ah, close enough. I don't feel like clarifying further, and this should be good enough to ensure proper caution.". His follow up includes elipses to indicate his actual uncertainty, as he gives the one preventative step he knows about: Installing updates. NiceGuy1 (talk) 06:22, 9 January 2018 (UTC)

Thoughts by someone who just arrived

I just read the available explanation, and it seems fairly complete to me, someone who knew next to nothing about spectre and meltdown besides their names before reading. In my opinion, the 'something seems to be missing' tag can be removed. However, as I am no expert on the matter, I will leave someone else to decide and perform (or not perform) the action of removing it. 172.68.65.186 02:30, 8 January 2018 (UTC)

I agree it is almost complete. Have added a missing piece to the incomplete reason. For once here was a subject I did not really know much about (except the trolley prolem ;-) and it was a neat explanation people have made. Thanks. --Kynde (talk) 13:25, 8 January 2018 (UTC)