News Serious security flaw in Intel processors

[Quick_Nick]

Yesterday, Microsoft released an update to Visual Studio that provides an optional compiler flag to mitigate Spectre variant 1 (Bounds Check Bypass).

https://blogs.msdn.microsoft.com/vcblog/2018/01/15/spectre-mitigations-in-msvc/

They admit that their analysis might not identify all possible instances of Variant 1 and they will not publicly comment on these limitations.

 

[ADSWNJ]

Linus is famous for these kinds of outbursts. Honestly, it must be a total nightmare working in any of his communities.

I can see the impact of the patches on any older machines resuming from hibernate. But if that's necessary to stop my browser being pwned, then I'm in.

The long term answer is a new CPU, and whilst considering that, the ultimate penalty for Intel will be if enough people choose AMD instead. With AMD finally having a competitive mainstream server CPU again, I see this being an interesting couple of years for enterprise IT.

 

[Keatah]

When can we expect consumer-level PCs and CPUs that are immune to this sort of thing? Is intel even working on something?

 

[ADSWNJ]

When can we expect consumer-level PCs and CPUs that are immune to this sort of thing? Is intel even working on something?

Today.

Buy an AMD CPU and it's immune. Ignore all the distraction noise ... this is an Intel-only longer term impact, not AMD.

 

[Artlav]

Most surprisingly, AMD CPUs today appear to give twice the bang for half the price. I don't remember that ever happening before.

 

[Loru]

After updating all of my PCs at work I can see performance hit. GPU assisted work got less impact but we're mostly working on CPU intensive processes (CorelDraw, Adobe Acrobat and RIPs) and in Corel (with custom VB toolset) I noticed 30% decrease in performance.

 

[Face]

Today.

Buy an AMD CPU and it's immune. Ignore all the distraction noise ... this is an Intel-only longer term impact, not AMD.

Hm. The example from the Spectre paper works on a Ryzen machine I've tried just as well. Are there patches available for these CPUs that fix it?

---------- Post added at 10:19 ---------- Previous post was at 10:15 ----------

They admit that their analysis might not identify all possible instances of Variant 1 and they will not publicly comment on these limitations.

Sure, because security by obscurity worked so well in the past.

 

[MeDiCS]

Today.

Buy an AMD CPU and it's immune. Ignore all the distraction noise ... this is an Intel-only longer term impact, not AMD.

AMD is not immune, and neither are even other architectures such as ARM or even PowerPC. Intel just screwed up really bad and is even more vulnerable than its competitors.

Personally, I've always preferred Intel but my next CPU will probably be an AMD.

 

[ADSWNJ]

OK - immune is not technically accurate, but for most people, it's good enough. Note I'm just talking Intel CPU vs AMD CPU here (so ARM, GPU, etc, outscoped).

My assertion is that AMD is immume to the main painful fix (i.e. Meltdown mitigation), and there is negligible impact OS fixes already delivered for the other issues (Spectre). Therefore, if you have AMD, you are good. If you have Intel, then you have some impact for even newest CPUs, and more impact for older CPUs, depending on how much kernel transition activity your workload has.


More detail: there are three vulnerabilities being discussed:

• Rogue Data Cache Load (a.k.a. Meltdown)
• Bounds Check Bypass (a.k.a. Spectre variant 1)
• Branch Target Injection (a.k.a. Spectre variant 2)

For #1, this is Intel but not AMD. Intel is not doing proper security checks on kernel page speculative access, leading to a fairly trivial exploit to access memory outside of your unprivileged user space. The fix is something called Kernel Page Table Isolation, which is a performance penalty on Intel. Why not AMD? Because it respects kernel page table permissions in its speculation code paths, like Intel will have to do from the next generation of CPUs.

For #2 - it's a much broader issue and did indeed impact AMD, but the OS fix is already available and it's negligible impact.

For #3 - AMD states that their architecture is much more resistant to this, and there is a near zero risk of exploit on their CPUs. Plus no research code highlighting this issue has yet been made.

So ... advantage to AMD here, especially with their new CPUs finally being competitive for both desktop and server.

Disclosures: I have no professional association with AMD or Intel, and this is my personal opinion only.

Sources of good reading:
https://www.amd.com/en/corporate/speculative-execution
https://medium.com/@mattklein123/meltdown-spectre-explained-6bc8634cc0c2

 

[MeDiCS]

OK - immune is not technically accurate, but for most people, it's good enough. Note I'm just talking Intel CPU vs AMD CPU here (so ARM, GPU, etc, outscoped).

My assertion is that AMD is immume to the main painful fix (i.e. Meltdown mitigation), and there is negligible impact OS fixes already delivered for the other issues (Spectre). Therefore, if you have AMD, you are good. If you have Intel, then you have some impact for even newest CPUs, and more impact for older CPUs, depending on how much kernel transition activity your workload has.


More detail: there are three vulnerabilities being discussed:

• Rogue Data Cache Load (a.k.a. Meltdown)
• Bounds Check Bypass (a.k.a. Spectre variant 1)
• Branch Target Injection (a.k.a. Spectre variant 2)

For #1, this is Intel but not AMD. Intel is not doing proper security checks on kernel page speculative access, leading to a fairly trivial exploit to access memory outside of your unprivileged user space. The fix is something called Kernel Page Table Isolation, which is a performance penalty on Intel. Why not AMD? Because it respects kernel page table permissions in its speculation code paths, like Intel will have to do from the next generation of CPUs.

For #2 - it's a much broader issue and did indeed impact AMD, but the OS fix is already available and it's negligible impact.

For #3 - AMD states that their architecture is much more resistant to this, and there is a near zero risk of exploit on their CPUs. Plus no research code highlighting this issue has yet been made.

So ... advantage to AMD here, especially with their new CPUs finally being competitive for both desktop and server.

Disclosures: I have no professional association with AMD or Intel, and this is my personal opinion only.

Sources of good reading:
https://www.amd.com/en/corporate/speculative-execution
https://medium.com/@mattklein123/meltdown-spectre-explained-6bc8634cc0c2

You're right that the impact is way less on anything but Intel CPUs, but the point is AMD is not immune. IMO, it's not even near good enough to call it that for most people. Spectre var 1 is specially problematic because it requires patches or recompiles (example: https://blogs.msdn.microsoft.com/vcblog/2018/01/15/spectre-mitigations-in-msvc/) for almost everything touching sensitive info. And those patches do reduce performance (even if by only a small percent from the benchmarks I've seen).

AMD's page is a bit misleading in that they say (about Spectre var 1): "We believe this threat can be contained with an operating system (OS) patch [...]". Unless they are planning on shipping an updated microcode to disable speculative execution (leading to a scandalous performance hit), OS patches will only protect the OS. Everything else (browsers, JIT compilers, cryptographic software, etc) will have to be patched with varying degrees of difficulty.

 

[Notebook]

http://www.bbc.co.uk/news/technology-42872301

Microsoft has disabled a flawed Intel software update that was causing some customers' computers to reboot unexpectedly.
Intel had issued its software patch to address a security issue affecting millions of its processors worldwide.
But the software caused many machines to reboot or shut down and Intel later told people not to install it.

 

[Keatah]

When can we expect consumer-level PCs and CPUs that are immune to this sort of thing? Is intel even working on something?

The answer to this is the IceLake or Saphhire Rapids architectures coming in 2019/2020 respectively. Provided the roadmap holds and there are no more problems building at 7nm or 5nm.

 

[RisingFury]

Intel managed to turn this into a full blown FUBAR.

 

[Urwumpe]

Intel managed to turn this into a full blown FUBAR.

I can agree - looks like NVidia did the same. My notebook is currently only running for limited time before a crash&restart loop in the Nvidia driver results in 100% Kernel CPU load and system freeze.

---------- Post added at 19:05 ---------- Previous post was at 18:29 ----------

Removed NV driver... all works fine.
Reinstalled the latest driver... SNAFU.

EDIT: Manually reverting to an older version of the driver fixed it. Maybe not related to the SPECTRE Bug itself, despite GPUs also fixing it currently

 

[Quick_Nick]

I can agree - looks like NVidia did the same. My notebook is currently only running for limited time before a crash&restart loop in the Nvidia driver results in 100% Kernel CPU load and system freeze.

---------- Post added at 19:05 ---------- Previous post was at 18:29 ----------

Removed NV driver... all works fine.
Reinstalled the latest driver... SNAFU.

EDIT: Manually reverting to an older version of the driver fixed it. Maybe not related to the SPECTRE Bug itself, despite GPUs also fixing it currently

As mentioned at some point previously, GPUs are not affected. nVidia was misunderstood when they said they're patching the computers that they use (obviously they have to hook their GPUs up to something with a CPU for real testing).

I have had plenty of times myself where reverting a graphics driver gave better performance. Unless you're playing a brand new game that just received optimizations, it's not always worthwhile keeping up with the latest drivers. If it ain't broke, don't patch it.

 

[Urwumpe]

As mentioned at some point previously, GPUs are not affected. nVidia was misunderstood when they said they're patching the computers that they use (obviously they have to hook their GPUs up to something with a CPU for real testing).

I have had plenty of times myself where reverting a graphics driver gave better performance. Unless you're playing a brand new game that just received optimizations, it's not always worthwhile keeping up with the latest drivers. If it ain't broke, don't patch it.

Still had the 100% CPU and no reaction to input situation just now during booting, this time without a driver being the cause. Looks like something is badly broken in Windows since the last update.

 

[Face]

Looks like something is badly broken in Windows since the last update.

Hysterisch gewachsen. :rofl: Translation: grown hysterically, in contrast to historically grown (or better yet: evolved).

 

[Urwumpe]

Hysterisch gewachsen. :rofl: Translation: grown hysterically, in contrast to historically grown (or better yet: evolved).

Exactly. I can't really tell which component causes it now. Before reverting the driver, it was constantly involving the Geforce driver, which left traces in the event log. Now the event log is clean until the forced reboot.

There seems to be some sort of cascade - system performance suddenly degrades until it is no longer reacting to events, while CPU activity goes to 100% without any application causing it (100% kernel load) .

---------- Post added at 10:03 ---------- Previous post was at 09:49 ----------

OK, Windows Branch Injection Patch is installed, but disabled as it should be right now. Back to square one.

---------- Post added at 11:35 ---------- Previous post was at 10:03 ----------

Reverting to driver version 388 seems to fix it now. For now.

 

[Notebook]

Generic question.

I have two pc's that haven't been switched on for about 3 months. Both about 9 months old, an i3 and i7 with Nvidia graphics card, the i7 a 1060? or nearly top of the range catd

House is in uproar with building work, so no time to play with them. most frustrating!

Should I wait a few more weeks, see if this gets a final patch,or just power them up now the building work is finished?

N.

 

[RisingFury]

I don't generally keep up with latest drivers at all. If your GPU is ~1 year old or older, it's unlikely to receive any performance boost from new drivers. You just risk instability for no gain.